GHSA-f89h-2fjh-2r9q
High · 7.8CVSS
7.8
EPSS
—
Published
May 7, 2026
CISA due date
—
The record
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | gix-fs | 0 | 0.21.1 |
Related vulnerabilities
- CVE-2026-44471 gitoxide is an implementation of git written in Rust. Same vulnerability
- CVE-2024-35186 gitoxide is a pure Rust implementation of Git. Also affects gix-fs
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59
- CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for… CWE-59