Threats tagged 'rustsec-2024-0349'

CVE-2024-35186 is a vulnerability in gix-worktree where the software does not properly verify that paths during checkout remain inside the working tree. This allows specially crafted repositories to create files outside the intended directory, including in locations where arbitrary code execution can occur, such as .git directories or parent directories. The flaw enables attackers to install malicious hooks or place files that execute with user privileges. The vulnerability affects versions before 0.34.0 and has been fixed in version 0.34.0.