gix traversal outside working tree enables arbitrary code execution
Priority HIGH 73CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00816 57th percentileScored 2026-11-07
Fix Fixed gitoxide (Byron): 0.36.0gix-worktree-state (crates.io): 0.11.0+6 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Byron | gitoxide | before 0.36.0 | 0.36.0 | Patch available | CNA |
| — | gix-worktree-state (crates.io) | before 0.11.0 | 0.11.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gitoxide (crates.io) | before 0.36.0 | 0.36.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gix-fs (crates.io) | before 0.11.0 | 0.11.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gix-worktree (crates.io) | before 0.34.0 | 0.34.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gix (crates.io) | before 0.63.0 | 0.63.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gitoxide-core (crates.io) | before 0.38.0 | 0.38.0 | Patch available | GHSA-7w47-3wg8-547c |
| — | gix-index (crates.io) | before 0.33.0 | 0.33.0 | Patch available | GHSA-7w47-3wg8-547c |
- gitoxide VendorByron Affected before 0.36.0 Fixed in 0.36.0 Patch available CNA
- gix-worktree-state (crates.io) Vendor— Affected before 0.11.0 Fixed in 0.11.0 Patch available GHSA-7w47-3wg8-547c
- gitoxide (crates.io) Vendor— Affected before 0.36.0 Fixed in 0.36.0 Patch available GHSA-7w47-3wg8-547c
- gix-fs (crates.io) Vendor— Affected before 0.11.0 Fixed in 0.11.0 Patch available GHSA-7w47-3wg8-547c
- gix-worktree (crates.io) Vendor— Affected before 0.34.0 Fixed in 0.34.0 Patch available GHSA-7w47-3wg8-547c
- gix (crates.io) Vendor— Affected before 0.63.0 Fixed in 0.63.0 Patch available GHSA-7w47-3wg8-547c
- gitoxide-core (crates.io) Vendor— Affected before 0.38.0 Fixed in 0.38.0 Patch available GHSA-7w47-3wg8-547c
- gix-index (crates.io) Vendor— Affected before 0.33.0 Fixed in 0.33.0 Patch available GHSA-7w47-3wg8-547c
Remediation
- Fix · CNA gitoxide (Byron) Fixed in 0.36.0
- Fix · GHSA-7w47-3wg8-547c gix-worktree-state (crates.io) Fixed in 0.11.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gitoxide (crates.io) Fixed in 0.36.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gix-fs (crates.io) Fixed in 0.11.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gix-worktree (crates.io) Fixed in 0.34.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gix (crates.io) Fixed in 0.63.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gitoxide-core (crates.io) Fixed in 0.38.0 Advisory →
- Fix · GHSA-7w47-3wg8-547c gix-index (crates.io) Fixed in 0.33.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-35186
- 2026-10-03 Alias added: GHSA-7w47-3wg8-547c
References
More Byron vulnerabilities
- TI-2024-27055 gitoxide's gix-path can use a fake program files location CVSS 3.1MEDIUM 6.8
- TI-2024-21756 gix-transport indirect code execution via malicious username CVSS 3.1MEDIUM 6.4
- TI-2024-30454 gix-path improperly resolves configuration path reported by Git CVSS 3.1MEDIUM 6.0
- TI-2024-23269 gix refs and paths with reserved Windows device names access the devices CVSS 3.1MEDIUM 5.4
- TI-2024-30376 gix-path uses local config across repos when it is the highest scope CVSS 3.1LOW 2.5
- TI-2024-29380 gitoxide-core does not neutralize special characters for terminals CVSS 3.1LOW 2.5
Sources
- CVE-2024-35186 · CVE Program
- CVE-2024-35186 · NVD
- FIRST EPSS
- GHSA-7w47-3wg8-547c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences