Threats affecting pkg:cargo/gix-fs

CVE-2024-35186 is a path traversal vulnerability in gix-fs that allows a specially crafted repository to place files outside the intended working tree during checkout. This can lead to arbitrary code execution by installing malicious files such as Git hooks outside the repository directory. The issue arises because gix-fs and related components do not properly verify that paths remain within the working tree, allowing upward or downward traversal using specially named trees or blobs. The vulnerability affects versions before 0.11.0 and is fixed in 0.11.0.