https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:40:37.899325+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-248605 EUVD-2026-248605 2026-10-04T03:40:37.904088+00:00 EUVD-2026-248605 https://cve.radiocsirt.org/vuln/fkie_cve-2023-53158 fkie_cve-2023-53158 2026-10-04T03:40:37.904120+00:00

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

 https://cve.radiocsirt.org/vuln/ghsa-rrjw-j4m2-mf34 GHSA-rrjw-j4m2-mf34 — gix-transport code execution vulnerability 2026-10-04T03:40:37.904151+00:00

Affected: crates.io: gix-transport

The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.

PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`.

Thanks for [vin01](https://github.com/vin01) for disclosing this issue.

 https://cve.radiocsirt.org/vuln/msrc_cve-2023-53158 msrc_CVE-2023-53158 — The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$I… 2026-10-04T03:40:37.904179+00:00 msrc_CVE-2023-53158 https://cve.radiocsirt.org/vuln/rustsec-2023-0064 RUSTSEC-2023-0064 — gix-transport code execution vulnerability 2026-10-04T03:40:37.904196+00:00

Affected: crates.io: gix-transport

The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.

PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`

This will launch a calculator on OSX.

See <https://secure.phabricator.com/T12961> for more details on similar vulnerabilities in `git`.

Thanks to [vin01](https://github.com/vin01) for disclosing the issue.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-53158 UBUNTU-CVE-2023-53158 2026-10-04T03:40:37.904219+00:00

Affected: Ubuntu:24.04:LTS: rust-gix-transport, Ubuntu:25.10: rust-gix-transport, Ubuntu:26.04:LTS: rust-gix-transport

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.