https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:37:47.673648+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-53158 CVE-2023-53158 2026-10-03T17:37:47.675309+00:00

Affected: GitoxideLabs gix-transport

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

 https://cve.radiocsirt.org/vuln/ghsa-rrjw-j4m2-mf34 GHSA-rrjw-j4m2-mf34 — gix-transport code execution vulnerability 2026-10-03T17:37:47.675380+00:00

Affected: crates.io: gix-transport

The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.

PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`.

Thanks for [vin01](https://github.com/vin01) for disclosing this issue.