Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

gix-validate

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

    GHSA-p3hw-mv63-rf9w

    Affected
    • crates.io gix-validate <= 0.10.0
    Fixed in
    0.11.1· Vendor fix available
    Issue
    Submodule name validation bypass plus missing validation in production code paths allows path traversal via crafted .gitmodules. Combined with a trust inheritance flaw in Submodule::open(), this enables reading arbitrary git repository configs (including credentials) from traversed paths with full trust (CWE-22, CWE-200). Details Bug 1: Validation bypass in gix-validate/src/submodule.rs (lines 27-42) The name() function uses name.find(b"..") which returns only the FIRST occurrence. If the first .. is embedded in a non-traversal context, the function returns Ok without checking subsequent ../ sequences: Bypass: a..b/../../../.git/ passes because find(b"..") returns position 1 (the .. in a..b), checks name[3] == b'b', and returns Ok. The real /../../../ is never checked. Bug 2: Validation never called in production gixvalidate::submodule::name() has zero production callers (only test code). The names() iterator in gix-submodule/src/access.rs:29 explicitly documents it returns…

    Recommended action: Upgrade to 0.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →