Executive brief
Traversal outside working tree enables arbitrary code execution
Affected products
- crates.io gix-worktree
- crates.io gitoxide-core
- crates.io gix-worktree-state
- crates.io gix
- crates.io gix-index
- crates.io gix-fs
- crates.io gitoxide
Junglewise Threat Intelligence
CVE-2024-35186: RUSTSEC-2024-0350 - Traversal outside working tree enables arbitrary code execution
CVE-2024-35186 · Severity: low · CVSS 3.1 · Published 2024-05-22
Technologies: gix-worktree (crates.io), gitoxide-core (crates.io), gix-worktree-state (crates.io), gix (crates.io), gix-index (crates.io), gitoxide (crates.io). Vendors: crates.io.
Related threats
- gitoxide path traversal in submodule name validation
- gitoxide symlink following in .gitmodules file
- gitoxide path traversal in submodule name resolution
- Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execu
- gitoxide gix-submodule command injection in gix_submodule::File::update