gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade rust-analyzerUpgrade rust-debugger-commonUpgrade rust-docUpgrade rust-toolset-srpm-macrosUpgrade cargoUpgrade rust-std-staticUpgrade rust-gdbUpgrade rustUpgrade clippyUpgrade rust-srcUpgrade rust-toolsetUpgrade rustfmt | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade cargo-c-debuginfoUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade cargo-cUpgrade rustUpgrade rust-debuginfoUpgrade rustfmtUpgrade rust-analyzer-debuginfoUpgrade rust-lldbUpgrade rust-debugsourceUpgrade clippy-debuginfoUpgrade rust-srcUpgrade rustfmt-debuginfoUpgrade cargoUpgrade rust-cargo-c-debugsourceUpgrade rust-toolset-srpm-macrosUpgrade rust-docUpgrade rust-std-static-wasm32-wasip1Upgrade rust-gdbUpgrade cargo-debuginfoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-analyzerUpgrade rust-toolsetUpgrade clippy | Oct 13, 2026 | Sep 25, 2026 |
| Redhat_linux | — | — | Sep 28, 2026 | Sep 25, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub