Threats tagged 'rustsec-2024-0348'

CVE-2024-35186 is a vulnerability in gix-index where the software does not properly verify that file paths during checkout remain within the working tree. This allows specially crafted repositories to create or overwrite files outside the intended directory, including in locations where arbitrary code execution can occur, such as .git hooks. The flaw arises from insufficient path validation, enabling directory traversal via tree or blob names containing '..', '.git', or path separators. A fix is available in version 0.33.0.