CVE-2026-33056 — Cargo tar crate allows malicious crates to modify filesystem permissions

CVE-2026-33056 affects the tar crate used by Cargo to extract packages during builds. A malicious crate could change permissions on arbitrary directories on the filesystem when extracted. Rust 1.94.1 (released 2026-03-26) ships the patched tar crate. For crates.io users, the registry blocked exploitative uploads on 2026-03-13 and audited all historically published crates — no affected crates were found. Users of private or alternate registries should contact their vendor and upgrade to Rust 1.94.1 immediately.