crates.io/gix-worktree CVE-2024-35186: high 8.8, EPSS 0.82%

gix traversal outside working tree enables arbitrary code execution

Action: Upgrade gix-worktree to 0.34.0 or later.

cargo update -p gix-worktree --precise 0.34.0

Affected

Fixed versions

Sources

• osv: GHSA-7w47-3wg8-547c#crates.io/gix-worktree
• https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c
• https://nvd.nist.gov/vuln/detail/CVE-2024-35186
• https://github.com/Byron/gitoxide
• https://rustsec.org/advisories/RUSTSEC-2024-0348.html
• https://rustsec.org/advisories/RUSTSEC-2024-0350.html

CVE-2024-35186 · published 2024-05-22T14:05:58Z · modified 2026-09-10T03:50:13.611207173Z · JSON