Freedom251 › Software Composition Analysis Software
cargo-audit
What cargo-audit is
cargo-audit is a free, open-source Cargo subcommand that checks Cargo.lock files for Rust crate security advisories recorded in the RustSec Advisory Database. It supports Rust and Cargo on Linux and macOS and requires Rust 1.74 or later. Install it with `cargo install cargo-audit`. The database covers advisories filed against crates published through crates.io. Advisories can be excluded with `--ignore` or handled through audit.toml. An experimental `cargo audit fix` can update vulnerable dependency requirements in Cargo.toml and offers a dry run. For compiled programs, `cargo audit bin` can scan binaries; results are fully accurate when dependency data from cargo-auditable is present. Without it, recovery from panic messages misses embedded C code and roughly half of Rust dependencies. The README recommends the audit-check GitHub Action for GitHub Actions. It also cautions against running the tool on untrusted projects: creating a missing Cargo.lock runs `cargo update --workspace`, and Cargo may execute project code. The crates are licensed under Apache License 2.0 or MIT, at the user's choice.
Who it suits
It suits Rust developers who want to check Cargo dependencies against RustSec advisories, including teams using GitHub Actions. Binary scanning has important limits when binaries lack cargo-auditable dependency data.
What it does well
- Free and open source
- Checks Cargo.lock against RustSec advisories
- Advisory exceptions via `--ignore` or audit.toml
- Experimental fixes support a dry run
What to know first
- Requires Rust 1.74 or later
- Binary recovery misses embedded C and roughly half of Rust dependencies
- Run only on trusted projects
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| cargo-audit | Open-source Cargo subcommand · Requires Rust 1.74 or later | Free |
As rustsec.org lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
cargo-audit focuses on Rust crate advisories and provides configurable exceptions plus an experimental dependency-fix command. Its binary scan is less complete without cargo-auditable data, and its trusted-project warning matters when a lockfile must be generated.
Facts from cargo-audit's own pages
- Advisory data exchange
- RustSec exports advisory data to OSV in real time, and its data is imported by the GitHub Advisory Database. · rustsec.org, 11 Oct 2026
- Advisory handling
- Advisories can be ignored with the `--ignore` option or configured in audit.toml. · github.com, 11 Oct 2026
- Binary scanning
- The `cargo audit bin` subcommand scans compiled binaries; results are fully accurate when binaries include dependency data from cargo-auditable. · github.com, 11 Oct 2026
- Binary scanning limit
- For binaries not built with cargo-auditable, dependency recovery from panic messages misses embedded C code and roughly half of Rust dependencies. · github.com, 11 Oct 2026
- CI integration
- The README recommends the audit-check GitHub Action for using cargo-audit on GitHub Actions. · github.com, 11 Oct 2026
- Fix command
- An experimental `cargo audit fix` feature can update vulnerable dependency requirements in Cargo.toml and supports a dry run. · github.com, 11 Oct 2026
- Installation
- Install it as a Cargo subcommand with `cargo install cargo-audit`. · github.com, 11 Oct 2026
- License
- The cargo-audit crates are licensed under either Apache License 2.0 or MIT, at the user's option. · github.com, 11 Oct 2026
- Maintainer
- The RustSec Advisory Database is maintained by the Rust Secure Code Working Group. · rustsec.org, 11 Oct 2026
- Purpose
- Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database. · rustsec.org, 11 Oct 2026
- Requirements
- cargo-audit requires Rust 1.74 or later. · github.com, 11 Oct 2026
- Security scope
- The RustSec Advisory Database contains security advisories filed against Rust crates published via crates.io. · rustsec.org, 11 Oct 2026
- Usage caution
- The README advises running cargo-audit only on trusted projects because generating a missing Cargo.lock runs cargo update --workspace and Cargo may execute project code. · github.com, 11 Oct 2026