Threats affecting pkg:cargo/gix-worktree

On Windows, the gix-worktree tool allows Git repositories to include references or file paths named after legacy Windows device names (e.g., CON, CONIN$, CONOUT$, COM1). Accessing such refs causes reads from system devices, potentially blocking operations, while checking out files with these names writes arbitrary data to devices like the console or serial ports. This can lead to denial of service or deceptive console output that appears to come from the application, facilitating social engineering. The issue affects gix-worktree versions prior to 0.34.0 and has a medium severity rating.

CVE-2024-35186 is a vulnerability in gix-worktree where the software does not properly verify that paths during checkout remain inside the working tree. This allows specially crafted repositories to create files outside the intended directory, including in locations where arbitrary code execution can occur, such as .git directories or parent directories. The flaw enables attackers to install malicious hooks or place files that execute with user privileges. The vulnerability affects versions before 0.34.0 and has been fixed in version 0.34.0.