TI-2024-29380 Aliases CVE-2024-43785 GHSA-88g2-r9rw-g55h

gitoxide-core does not neutralize special characters for terminals

MEDIUM 46CWE-150Published 2024-08-22 · Updated 2024-08-22

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00198 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Byron	gitoxide	up to 0.41.0	—	No fix listed	CNA
—	gitoxide-core (crates.io)	up to 0.45.0	—	No fix listed	GHSA-88g2-r9rw-g55h
—	gitoxide (crates.io)	up to 0.41.0	—	No fix listed	GHSA-88g2-r9rw-g55h

gitoxide VendorByron Affected up to 0.41.0 Fixed in — No fix listed CNA
gitoxide-core (crates.io) Vendor— Affected up to 0.45.0 Fixed in — No fix listed GHSA-88g2-r9rw-g55h
gitoxide (crates.io) Vendor— Affected up to 0.41.0 Fixed in — No fix listed GHSA-88g2-r9rw-g55h

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:byron:gitoxide::::::::	—	—	Byron

cpe:2.3:a:byron:gitoxide:*:*:*:*:*:*:*:* Versions — — ·Byron

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-43785
2026-10-03 Alias added: GHSA-88g2-r9rw-g55h

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-43785

Other 4

TI-2024-23260 gix traversal outside working tree enables arbitrary code execution CVSS 3.1HIGH 8.8
TI-2024-27055 gitoxide's gix-path can use a fake program files location CVSS 3.1MEDIUM 6.8
TI-2024-21756 gix-transport indirect code execution via malicious username CVSS 3.1MEDIUM 6.4
TI-2024-30454 gix-path improperly resolves configuration path reported by Git CVSS 3.1MEDIUM 6.0
TI-2024-23269 gix refs and paths with reserved Windows device names access the devices CVSS 3.1MEDIUM 5.4
TI-2024-30376 gix-path uses local config across repos when it is the highest scope CVSS 3.1LOW 2.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences