ghsa:GHSA-Q54R-JF2P-RFR2: gix >= 0.88.0, <= 0.89.0

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options(). Affected range: >= 0.88.0, <= 0.89.0. Fixed version: 0.90.0.

Affected technology

gix · >= 0.88.0, <= 0.89.0
Vendor not specified by the source

Component: Not specified by the source
Function: gix

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · User interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 24-Oct-2026 01:47 UTC

Product: gix
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-q54r-jf2p-rfr2.html