gitoxide gix: untrusted .git/config can disable .git path-protection checks, enabling hook/config overwrite (GHSA-q54r-jf2p-rfr2)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-40034
The gix crate's Cache::protectoptions() read core.protectHFS, core.protectNTFS and gitoxide.core.protectWindows with an unfiltered config accessor instead of the trust-aware booleanfilter() used elsewhere, so settings from an untrusted repository-local .git/config (Trust::Reduced, e.g. ownership mismatch on shared filesystems) were honored. An attacker controlling a repo's .git/config on a shared or CI filesystem can disable these protections; crafted tree entries (NTFS short names, alternate data streams, HFS+ ignorable code points) then resolve to .git on case-insensitive filesystems during checkout, index build, merge or tree edit, allowing overwrite of hooks/config and plausibly arbitrary command execution via hook execution. Affects gix 0.88.0–0.89.0; fixed in gix 0.90.0. No in-the-wild exploitation known; a PoC test is public.
What to do
- Upgrade gix to 0.90.0 or later and rebuild any tools or binaries that depend on the affected versions
- Audit dependencies and lockfiles for gix 0.88.0–0.89.0 across Rust projects and CI images
- Avoid opening untrusted repositories with gix-based tools on shared, network-mounted, or reused CI workspaces until patched
- Treat checkouts from other users on multi-user hosts as untrusted; verify .git/hooks and .git/config integrity after opening shared repos
Fixed versions
Sources
All live incidents on Threat Watch
