CVE-2024-45405 gix-path improperly resolves configuration path reported by Git

🗓️ 06 Sep 2024 13:10:31Reported by GoogleType

osv🔗 osv.dev👁 11 Views

Prior to version 0.10.11, 'gix-path' in 'gitoxide' (a Rust-based 'git' implementation) improperly resolves paths, enabling local attacker to inject configuration leading to code execution. Patched in version 0.10.11

Reporter	Title	Published	Views	Family All 39
Chainguard	CVE-2024-45405 vulnerabilities	6 Sep 202413:15	–	cgr
Circl	CVE-2024-45405	6 Sep 202405:50	–	circl
CNNVD	gitoxide 安全漏洞	6 Sep 202400:00	–	cnnvd
CVE	CVE-2024-45405	6 Sep 202413:10	–	cve
Cvelist	CVE-2024-45405 gix-path improperly resolves configuration path reported by Git	6 Sep 202413:10	–	cvelist
Debian CVE	CVE-2024-45405	6 Sep 202413:10	–	debiancve
EUVD	EUVD-2024-2833	3 Oct 202520:07	–	euvd
Github Security Blog	gix-path improperly resolves configuration path reported by Git	6 Sep 202419:55	–	github
NVD	CVE-2024-45405	6 Sep 202413:15	–	nvd
OPENSUSE Linux	onefetch-2.22.0-1.1 on GA media (moderate)	22 Sep 202400:00	–	opensuse

Source	Link
github	www.github.com/Byron/gitoxide/blob/1cfe577d461293879e91538dbc4bbfe01722e1e8/gix-path/src/env/git/mod.rs
github	www.github.com/Byron/gitoxide/security/advisories/GHSA-m8rp-vv92-46c7
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45405.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45405
github	www.github.com/Byron/gitoxide/commit/650a1b5cf25e086197cc55a68525a411e1c28031

10 Apr 2026 05:16Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16

EPSS0.00072