From a7e09a45bbee1dde3f2604abaab38001edc1bb0b Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 26 May 2026 19:54:52 -0400
Subject: [PATCH] cargo: add patches for CVE-2026-5222 and CVE-2026-5223

Upstream pull request: https://github.com/rust-lang/cargo/pull/17031

Fixes: CVE-2026-5222, https://blog.rust-lang.org/2026/05/25/cve-2026-5222/
Fixes: CVE-2026-5223, https://blog.rust-lang.org/2026/05/25/cve-2026-5223/
Not-cherry-picked-because: master will get these fixes via the rust 1.96 upgrade on 2026-05-28
(cherry picked from commit 5f1133b2f1e36b654119f042b8eaf9f16aff706c)
---
 pkgs/development/compilers/rust/cargo.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index a86e4a3d186d..7c3d4eb2a5e0 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -3,6 +3,7 @@
   stdenv,
   pkgsHostHost,
   pkgsBuildBuild,
+  fetchpatch,
   file,
   curl,
   pkg-config,
@@ -26,6 +27,23 @@ rustPlatform.buildRustPackage.override
     pname = "cargo";
     inherit (rustc.unwrapped) version src;
 
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-5222.patch";
+        url = "https://github.com/rust-lang/cargo/commit/c4d63a44234de22dc745231c416b80ed848d997f.patch";
+        stripLen = 1;
+        extraPrefix = "src/tools/cargo/";
+        hash = "sha256-YG7xtC308z+o1xVzrV81qqWov1121GVouyAXKflyBF8=";
+      })
+      (fetchpatch {
+        name = "CVE-2026-5223.patch";
+        url = "https://github.com/rust-lang/cargo/commit/285cebf58911eca5b7f177f5d0b1c53e1f646577.patch";
+        stripLen = 1;
+        extraPrefix = "src/tools/cargo/";
+        hash = "sha256-DbmPQ31N4AIYZEBiwwGAn59hgPsFEVTzA6PrI071LXE=";
+      })
+    ];
+
     # the rust source tarball already has all the dependencies vendored, no need to fetch them again
     cargoVendorDir = "vendor";
     buildAndTestSubdir = "src/tools/cargo";