CVE-2024-35186

What it actually does

During checkout, gix-worktree-state fails to verify that repository paths resolve inside the intended working tree, enabling a malicious repository to write files to arbitrary writable locations on the filesystem when cloned.

Why it matters to the business

Organizations using the affected Git implementation face risk of unauthorized file creation outside project directories, which can corrupt system files, overwrite configuration, or disrupt operations when developers or automated processes clone untrusted repositories.

How an attack unfolds

An attacker crafts a repository containing path traversal sequences in tree objects. A victim clones the repository using the vulnerable client, triggering checkout that writes attacker-controlled files to locations outside the working tree without code execution.

How to fix it

Upgrade byron/gitoxide to version 0.36.0 or later, which includes the fix at commit 4f98e94e0e8b79ed2899b35bef40f3c30b3025b0. Avoid cloning untrusted repositories until patched.

How to confirm the fix worked

Confirm the installed gitoxide version reports 0.36.0 or newer; test cloning a repository containing path traversal entries and verify no files appear outside the intended working tree.

Typical attack path

1. Attacker prepares a malicious Git repository embedding path traversal sequences
2. Victim clones the repository with the vulnerable gitoxide client
3. Client performs checkout without validating resolved paths against the working tree
4. Files are written to arbitrary writable locations on the host filesystem

How to detect it

Review clone and checkout logs for unexpected file creation events outside project directories; monitor filesystem activity during git operations for writes to paths containing traversal sequences.

What your security team should do

• Immediately update all gitoxide installations to the patched version
• Scan build and CI systems for use of gitoxide and enforce version pinning
• Educate developers on risks of cloning untrusted repositories until patches are applied