What’s Vulnerable › Vulnerabilities
CVE-2024-51990: Path traversal via crafted Git repositories in jj
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-07 · updated 2026-06-17
- Weakness: CWE-22
Description
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
Affected products
- martinvonz jj: before 0.23.0 — fixed in 0.23.0
How to fix
Upgrade to a fixed version: martinvonz jj 0.23.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-51990 or the next vulnerability affects your stack