Threats affecting pkg:cargo/gix-path

The gix-path library improperly resolves configuration file paths reported by Git when those paths contain unusual or non-ASCII characters. This flaw arises because gix-path does not use Git's null-terminated output option and attempts to parse quoted paths by stripping quotation marks without reversing encoding transformations. As a result, an attacker with limited local user access can craft malicious configuration files that gix-path mistakenly loads, potentially leading to code execution. The vulnerability affects versions before 0.10.11 and has a CVSS score of 6.0. A fix is available in version 0.10.11.

The gix-path library incorrectly treats local Git repository configuration as system-wide configuration under certain conditions, leading to potential leakage of sensitive information such as credentials between repositories. This occurs when higher scoped configuration files are missing or deliberately disabled, causing local configuration to be misinterpreted as installation-level configuration. This can result in credentials intended for one repository being sent to another during operations like cloning. The issue is fixed in version 0.10.10.

The gix-path crate version 0.10.8 on Windows can be tricked into executing a malicious git.exe placed in a fake Program Files directory by a limited user. This occurs because gix-path checks two hard-coded fallback paths for git.exe, including C:\Program Files (x86)\Git\mingw32\bin, which a limited user can create on 32-bit Windows systems. If the real git.exe is not found in the PATH, other users running applications using gix-path may execute the malicious git.exe, leading to potential privilege escalation. This vulnerability is fixed in version 0.10.9.