CVE-2026-100419

EUVD-2026-87366
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.9%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
gitoxidelabsgitoxide
𝑥
< 0.23.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-gix-fs
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-gix-fs
jammy
dne
noble
needs-triage
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
cargo
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
cargo-c
Amazon Linux 2023
0:0.10.25-1.amzn2023.0.1
fixed
cargo-c-debuginfo
Amazon Linux 2023
0:0.10.25-1.amzn2023.0.1
fixed
cargo-debuginfo
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
clippy
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
clippy-debuginfo
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-analyzer
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-analyzer-debuginfo
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-cargo-c-debugsource
Amazon Linux 2023
0:0.10.25-1.amzn2023.0.1
fixed
rust-debugger-common
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-debuginfo
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-debugsource
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-doc
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-gdb
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-lldb
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-src
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-std-static
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-std-static-wasm32-unknown-unknown
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-std-static-wasm32-wasip1
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-toolset
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rust-toolset-srpm-macros
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rustfmt
Amazon Linux 2
0:1.98.1-1.amzn2
fixed
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
rustfmt-debuginfo
Amazon Linux 2023
0:1.98.1-1.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
rust
Azure Linux 3.0
0:1.75.0-30.azl3
fixed
Common Weakness Enumeration
References
https://github.com/GitoxideLabs/gitoxide
https://github.com/GitoxideLabs/gitoxide/blob/gix-fs-v0.22.1/gix-fs/src/stack.rs#L185-L196
https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q
https://www.vulncheck.com/advisories/gitoxide-gix-fs-before-0.23.0-worktree-escape-via-symlink
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q