  Currently, little is known about the structure of the Cargo ecosystem and the
potential for vulnerability propagation. Many empirical studies generalize
third-party dependency governance strategies from a single software ecosystem
to other ecosystems but ignore the differences in the technical structures of
different software ecosystems, making it difficult to directly generalize
security governance strategies from other ecosystems to the Cargo ecosystem. To
fill the gap in this area, this paper constructs a knowledge graph of
dependency vulnerabilities for the Cargo ecosystem using techniques related to
knowledge graphs to address this challenge. This paper is the first large-scale
empirical study in a related research area to address vulnerability propagation
in the Cargo ecosystem. This paper proposes a dependency-vulnerability
knowledge graph parsing algorithm to determine the vulnerability propagation
path and propagation range and empirically studies the characteristics of
vulnerabilities in the Cargo ecosystem, the propagation range, and the factors
that cause vulnerability propagation. Our research has found that the Cargo
ecosystem's security vulnerabilities are primarily memory-related. 18% of the
libraries affected by the vulnerability is still affected by the vulnerability
in the latest version of the library. The number of versions affected by the
propagation of the vulnerabilities is 19.78% in the entire Cargo ecosystem.
This paper looks at the characteristics and propagation factors triggering
vulnerabilities in the Cargo ecosystem. It provides some practical resolution
strategies for administrators of the Cargo community, developers who use Cargo
to manage third-party libraries, and library owners. This paper provides new
ideas for improving the overall security of the Cargo ecosystem.
