The gix-path library improperly resolves configuration file paths reported by Git when those paths contain unusual or non-ASCII characters. This flaw arises because gix-path does not use Git's null-terminated output option and attempts to parse quoted paths by stripping quotation marks without reversing encoding transformations. As a result, an attacker with limited local user access can craft malicious configuration files that gix-path mistakenly loads, potentially leading to code execution. The vulnerability affects versions before 0.10.11 and has a CVSS score of 6.0. A fix is available in version 0.10.11.