Executive brief
gix-sec is a security library used by gitoxide (a Rust Git implementation) to validate repository ownership and prevent arbitrary code execution from untrusted repositories. On Windows, when running with full administrative privileges, gix-sec incorrectly bypasses safe.directory protections and treats all repositories as trusted, allowing a limited user account to trick an administrator into executing malicious code embedded in Git repository configuration.
Technical details
The vulnerability is a logic error in the Windows-specific implementation of path ownership validation in gix-sec (gix_sec::identity::is_path_owned_by_current_user). When checking if an administrator owns a directory, the code calls IsWellKnownSid and CheckTokenMembership on the running thread/process rather than on the directory itself. Since administrator processes are owned by the Administrators group, these checks always return true, bypassing the intended safe.directory protections. An attacker can craft a malicious Git repository (owned by a limited user account) with a core.sshCommand configuration that executes arbitrary payloads. When an administrator runs git/gix commands against this repository without explicitly whitelisting it via safe.directory, the malicious command executes. The attack requires Windows OS, the user being in the Administrators group, running with an unfiltered token (UAC elevation or UAC disabled), and program interaction with a repository owned or controlled by another user. Patch is available in gix-sec version 0.13.3.
Affected products
- GitoxideLabs gix-sec <= 0.13.2
Timeline
- 2026-09-02: disclosed
- 2026-09-09: advisory: Published in GitHub Advisory Database
- 2026-09-09: patched: Fixed in gix-sec 0.13.3