Rust 1.94.1 released — patches CVE-2026-33056 (tar crate privilege escalation via Cargo)

Rust 1.94.1 was released on 2026-03-26, shipping a patched version of the tar crate to fix CVE-2026-33056. The vulnerability allowed a malicious crate to change permissions on arbitrary directories when Cargo extracted it during a build. crates.io users are protected (the registry blocked exploitative uploads on 2026-03-13 and audited all past crates), but users of alternate private registries should verify their posture. Last known version in last-versions.json was also 1.94.1 (already tracked from 2026-03-28 scan), no version delta.