https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:03:20.553532+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-35186 CVE-2024-35186 — gix traversal outside working tree enables arbitrary code execution 2026-10-02T16:03:20.554953+00:00

Affected: Byron gitoxide

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

 https://cve.radiocsirt.org/vuln/ghsa-7w47-3wg8-547c GHSA-7w47-3wg8-547c — gix traversal outside working tree enables arbitrary code execution 2026-10-02T16:03:20.555017+00:00

Affected: crates.io: gix-worktree-state, crates.io: gitoxide, crates.io: gix-fs, crates.io: gix-worktree, crates.io: gix, crates.io: gitoxide-core, crates.io: gix-index

### Summary

During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application.

### Details

Although `gix-worktree-state` checks for collisions with existing files, it does not itself check if a path is really in the working tree when performing a checkout, nor do the path checks in `gix-fs` and `gix-worktree` prevent this. Cloning an untrusted repository containing specially crafted tree or blob names will create new files outside the repository, or inside the repository or a submodule's `.git` directory. The simplest cases are:

- A tree named `..` to traverse upward. This facilitates arbitrary code execution because files can be placed in one or more locations where they are likely to be executed soon. - A tree named `.git` to enter a `.git` directory. This facilitates arbitrary code execution because hooks can be installed.

A number of alternatives that achieve the same effect are also possible, some of which correspond to specific vulnerabilities that have affected Git in the past:

- A tree or blob whose name contains one or more `/`, to traverse upward or downward. For example, even without containing any tree named `..` or `.git`, a repository can represent a file named `../outside` or `.git/hooks/pre-commit`. This is distinct from the more intuitive case a repository containing trees that represent those paths. - In Windows, a tree or b…