CVE Feed

    Dashboard / CVE / CVE-2024-32884

    CVE-2024-32884

    gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs. This is related to the patched vulnerability GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. This issue has been patched in versions 0.35.0, 0.42.0 and 0.62.0.

    Published:Apr 26, 2024
    Last Modified:Apr 15, 2026
    EPS:Apr 26, 2024
    EPSS Score:0.00066
    CVSS Score:6.4

    Affected Products

    Vendor
    Byron
    Product
    Gitoxide

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-45405 (CVSS 6) — `gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and…
    CVE-2024-45305 (CVSS 2.5) — gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes …
    CVE-2024-43785 (CVSS 2.5) — gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most u…
    CVE-2024-40644 (CVSS 6.8) — gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into runni…
    CVE-2024-35197 (CVSS 5.4) — gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names r…
    CVE-2024-35186 (CVSS 8.8) — gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that path…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High