crates.io/gix CVE-2024-35186: high 8.8, EPSS 0.82%

gix traversal outside working tree enables arbitrary code execution

Action: Upgrade gix to 0.63.0 or later.

cargo update -p gix --precise 0.63.0

Affected

Fixed versions

Sources

• osv: GHSA-7w47-3wg8-547c#crates.io/gix
• https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c
• https://nvd.nist.gov/vuln/detail/CVE-2024-35186
• https://github.com/Byron/gitoxide
• https://rustsec.org/advisories/RUSTSEC-2024-0348.html
• https://rustsec.org/advisories/RUSTSEC-2024-0350.html

CVE-2024-35186 · published 2024-05-22T14:05:58Z · modified 2026-09-10T03:50:13.611207173Z · JSON