gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree...

zetlyn/cve-ghsa vulnerability ghsa GHSA-jjhr-hr59-47h4 cve CVE-2026-100419 known 2026-09-26

https://github.com/advisories/GHSA-jjhr-hr59-47h4

Properties

cvss7
receipt
Source
GitHub advisories
Its words
7.0
Read by
field:cvss.score
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-100419",
  "cvss": {
    "score": 7.0,
    "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.0,
      "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 7.3,
      "vector_string": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-59",
      "name": "Improper Link Resolution Before File Access ('Link Following')"
    }
  ],
  "description": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.",
  "epss": {
    "percentage": 0.00147,
    "percentile": 0.03311
  },
  "ghsa_id": "GHSA-jjhr-hr59-47h4",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jjhr-hr59-47h4",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jjhr-hr59-47h4"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100419"
    }
  ],
  "nvd_published_at": "2026-09-25T22:17:10Z",
  "published_at": "2026-09-26T00:32:18Z",
  "references": [
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5",
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100419",
    "https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875",
    "https://github.com/GitoxideLabs/gitoxide",
    "https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196",
    "https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink",
    "https://github.com/advisories/GHSA-jjhr-hr59-47h4"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T00:32:22Z",
  "url": "https://api.github.com/advisories/GHSA-jjhr-hr59-47h4",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-59
receipt
Source
GitHub advisories
Its words
CWE-59
Read by
field:cwes[].cwe_id
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-100419",
  "cvss": {
    "score": 7.0,
    "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.0,
      "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 7.3,
      "vector_string": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-59",
      "name": "Improper Link Resolution Before File Access ('Link Following')"
    }
  ],
  "description": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.",
  "epss": {
    "percentage": 0.00147,
    "percentile": 0.03311
  },
  "ghsa_id": "GHSA-jjhr-hr59-47h4",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jjhr-hr59-47h4",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jjhr-hr59-47h4"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100419"
    }
  ],
  "nvd_published_at": "2026-09-25T22:17:10Z",
  "published_at": "2026-09-26T00:32:18Z",
  "references": [
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5",
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100419",
    "https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875",
    "https://github.com/GitoxideLabs/gitoxide",
    "https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196",
    "https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink",
    "https://github.com/advisories/GHSA-jjhr-hr59-47h4"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T00:32:22Z",
  "url": "https://api.github.com/advisories/GHSA-jjhr-hr59-47h4",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severityhigh
From 7.0 to 8.9.
receipt
Source
GitHub advisories
Its words
high
Read by
field:severity
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-100419",
  "cvss": {
    "score": 7.0,
    "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.0,
      "vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 7.3,
      "vector_string": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-59",
      "name": "Improper Link Resolution Before File Access ('Link Following')"
    }
  ],
  "description": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.",
  "epss": {
    "percentage": 0.00147,
    "percentile": 0.03311
  },
  "ghsa_id": "GHSA-jjhr-hr59-47h4",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-jjhr-hr59-47h4",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-jjhr-hr59-47h4"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100419"
    }
  ],
  "nvd_published_at": "2026-09-25T22:17:10Z",
  "published_at": "2026-09-26T00:32:18Z",
  "references": [
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5",
    "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100419",
    "https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875",
    "https://github.com/GitoxideLabs/gitoxide",
    "https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196",
    "https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink",
    "https://github.com/advisories/GHSA-jjhr-hr59-47h4"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree...",
  "type": "unreviewed",
  "updated_at": "2026-09-26T00:32:22Z",
  "url": "https://api.github.com/advisories/GHSA-jjhr-hr59-47h4",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree... gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.