CVE-2024-35186: gix traversal outside working tree enables arbitrary code execution

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-23 · updated 2026-06-17
Weakness: CWE-23

Description

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

Affected products

Byron gitoxide: before 0.36.0 — fixed in 0.36.0

How to fix

Upgrade to a fixed version: Byron gitoxide 0.36.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-35186 or the next vulnerability affects your stack