CVE-2026-100419
highgitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree d…
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/GitoxideLabs/gitoxide disclosure@vulncheck.com
- https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196 disclosure@vulncheck.com
- https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875 disclosure@vulncheck.com
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5 disclosure@vulncheck.com
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-sym... disclosure@vulncheck.com
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q 134c704f-9b21-4f2e-91b3-4a467353bcc0