CVE-2026-100419

Name of the Vulnerable Software and Affected Versions gitoxide gix-fs versions prior to 0.23.0

Description A path validation bypass exists in the worktree checkout mechanism. This issue allows attackers to escape the worktree directory through symlink manipulation. When a forced checkout is performed with overwrite existing enabled, an attacker can create malicious repository trees where symlink entries replace validated directories. This causes subsequent files to be written outside the worktree via the symlink, potentially leading to file manipulation or code execution.

Recommendations Update gitoxide gix-fs to version 0.23.0 or later.