gitoxide gix path-protection bypass via untrusted .git/config

Severity: high · CVSS 7.3 · Published 2026-10-23

gitoxide is a Rust implementation of Git that handles repository operations. An attacker who controls a repository's configuration on a shared filesystem can disable filesystem path-protection checks, allowing specially crafted files to overwrite Git hooks and configuration. On case-insensitive filesystems like Windows NTFS or macOS HFS+, this can lead to arbitrary code execution when Git operations trigger hooks.

Technologies: gix (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.3, published 23 October 2026.
Which products and versions are affected?
gix (crates.io) >= 0.88.0, <= 0.89.0, SEMVER:introduced=0.88.0,fixed=0.90.0; Gitoxide Gix 0.88.0 through 0.89.0.
Is there a fix for This vulnerability?
Yes. gix (crates.io): upgrade to 0.90.0 or later. Until then: Avoid opening untrusted or other-user-owned repositories with gix-based tools on shared or case-insensitive filesystems until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network or with local access.
Am I affected?
Check whether you run gix (crates.io) or Gitoxide Gix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gix (crates.io): upgrade to 0.90.0 or later
    cargo update -p gix

Avoid opening untrusted or other-user-owned repositories with gix-based tools on shared or case-insensitive filesystems until upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-23"}]

Technical details

The vulnerability exists in gix's Cache::protect_options() function, which reads filesystem path-protection settings (core.protectHFS, core.protectNTFS, gitoxide.core.protectWindows) using an unfiltered boolean() accessor instead of the trust-aware boolean_filter() used elsewhere. Under Trust::Reduced (when repository ownership mismatches), untrusted repository-local .git/config sections should be rejected, but protect_options() honors them anyway, allowing attackers to disable .git-confusion checks during checkout, index creation, merge, or tree editing. The attacker can then use filesystem-specific encodings (NTFS short names like GIT~1, HFS+ ignorable code points) that resolve to .git on case-insensitive filesystems.

Affected products

  • gitoxide gix 0.88.0 through 0.89.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.