CVE-2024-32884: gix-transport indirect code execution via malicious username

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-26 · updated 2026-06-17
Weakness: CWE-77

Description

gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

Affected products

Byron gitoxide: before 0.35.0; before 0.62.0; before 0.42.0 — fixed in 0.35.0, 0.42.0, 0.62.0

How to fix

Upgrade to a fixed version: Byron gitoxide 0.35.0, 0.42.0, 0.62.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-32884 or the next vulnerability affects your stack