Check your Cargo.toml for vulnerable Rust crates
cargo update is enough.Checked against OSV.dev, CISA KEV, FIRST EPSS, npm, PyPI, deps.dev, endoflife.date and Docker Hub, live.
Sample: A Tokio worker’s Cargo.toml
A Tokio worker with caret requirements and two exact pins, and no Cargo.lock. Compare hyper’s finding, which a cargo update already fixes, with the exact =0.10.45 pin on openssl, which has to change by hand.
[package]
name = "acme-worker"
version = "0.1.0"
edition = "2021"
[dependencies]
tokio = { version = "1.18.0", features = ["full"] }
hyper = "0.14.5"
h2 = "=0.3.15"
openssl = "=0.10.45"
chrono = "0.4.19"
time = "0.1.43"
[dev-dependencies]
criterion = "0.3"
6 findings: 1 critical, 2 warnings and 3 low priority
7 packages from Cargo.toml
Critical: 15 known vulnerabilities in openssl 0.10.45
Cargo.toml0.10.79
Warning: CVE-2020-26235 in time 0.1.43
Cargo.toml0.2.23
Warning: 4 known vulnerabilities in h2 0.3.15
Cargo.toml0.4.16
Low: 3 known vulnerabilities in hyper 0.14.5
Cargo.toml0.14.12Your range already allows the fix
Low: 3 known vulnerabilities in tokio 1.18.0
Cargo.toml1.38.2Your range already allows the fix
Low: RUSTSEC-2020-0159 in chrono 0.4.19
Cargo.toml0.4.20Your range already allows the fix
Last checked against OSV.dev, deps.dev, CISA KEV and FIRST EPSS.
What it reads in Cargo.toml
[dependencies],[dev-dependencies]and[build-dependencies], including target tables such as[target.'cfg(unix)'.dependencies]and[workspace.dependencies].- Plain versions (
hyper = "0.14.5") and inline tables (tokio = { version = "1.18.0" }). Path and git dependencies have no registry version, so they’re skipped. - Dev dependencies are tagged Dev only and rank one level lower.
Caret requirements and Cargo.lock
Cargo reads chrono = "0.4.19" as ^0.4.19: any 0.4.x from 0.4.19 up. Without Cargo.lock we check that lowest version, then compare the requirement with the fix. If the requirement already allows the fixed version, the finding drops to low priority: cargo update fetches it. If not, as with a 0.1 requirement whose fix is in 0.2, the finding stays serious and you change the requirement.
With Cargo.lock we check the locked version instead. When the lock lists a crate at more than one version, we take the newest one your requirement allows.
How it compares with cargo audit
| Tool | What it reads and checks | Use it when |
|---|---|---|
| cargo audit | Your Cargo.lock, every crate in the tree, against the RustSec Advisory Database, including its informational advisories such as unmaintained crates. | You can run it in the project or in CI and want the whole dependency tree. |
| This check | The Cargo.toml and Cargo.lock you paste, with no Rust toolchain. Ranks by CISA KEV and EPSS, says which findings a cargo update fixes, and checks npm, Python, Go and Docker files in the same pass. | A quick look at a crate or repo you haven’t cloned, or a ranked task for your coding agent. |
Your Cargo.lock, every crate in the tree, against the RustSec Advisory Database, including its informational advisories such as unmaintained crates.
Use it when: You can run it in the project or in CI and want the whole dependency tree.
This check
The Cargo.toml and Cargo.lock you paste, with no Rust toolchain. Ranks by CISA KEV and EPSS, says which findings a cargo update fixes, and checks npm, Python, Go and Docker files in the same pass.
Use it when: A quick look at a crate or repo you haven’t cloned, or a ranked task for your coding agent.
Questions
Does it read Cargo.lock from my repo?
Yes. For a public repo it reads Cargo.lock at the root next to Cargo.toml. A workspace keeps one Cargo.lock at its root, and member crates in subfolders pick it up when you drop their Cargo.toml with it.
What are RUSTSEC ids?
Advisories from the RustSec Advisory Database, which OSV.dev includes. A flaw that also has a GHSA or CVE id is shown once.
Why does "1.18.0" show as ^1.18.0?
That’s how Cargo reads it: a bare version is a caret requirement, so tokio = "1.18.0" accepts any 1.x from 1.18.0 up. Only =1.18.0 pins one version.
Does it check my Rust version?
No. The Rust project supports only its newest stable release, so every older toolchain would read as end of life. Keeping rustup current covers it.
Is my Cargo.toml stored?
No. It’s read in memory to run the check, and only crate names and versions go to the public sources.
Go further than one check
Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.