CVE-2024-35186

gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0.

• CWE-23

• https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c
• https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35180OMERO.web provides a web based client and plugin infrastruct…6.1
• CVE-2024-35181Meshery is an open source, cloud native manager that enables…8.1
• CVE-2024-35182Meshery is an open source, cloud native manager that enables…8.1
• CVE-2024-35183wolfictl is a command line tool for working with Wolfi. A gi…4.4
• CVE-2024-35184Paperless-ngx is a document management system that transform…5.5
• CVE-2024-35185Minder is a software supply chain security platform. Prior t…5.3
• CVE-2024-35187Stalwart Mail Server is an open-source mail server. Prior to…9.1
• CVE-2024-35189Fides is an open-source privacy engineering platform. The Fi…6.5
• CVE-2024-3519The Media Library Assistant plugin for WordPress is vulnerab…6.1
• CVE-2024-35190Asterisk is an open source private branch exchange and telep…5.3
• CVE-2024-35191Formie is a Craft CMS plugin for creating forms. Prior to 2.…4.4
• CVE-2024-35192Trivy is a security scanner. Prior to 0.51.2, if a malicious…5.5