CVE-2026-100419

Name	CVE-2026-100419
Description	gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1149888

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-gix-fs (PTS)	trixie	0.12.1-1	vulnerable
	forky	0.22.1-1	vulnerable
	sid	0.24.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-gix-fs	source	(unstable)	(unfixed)			1149888

Notes

[trixie] - rust-gix-fs <no-dsa> (Minor issue)
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6p9q-f2xg-6pr5
Fixed by: https://github.com/GitoxideLabs/gitoxide/commit/b62498378b8bc2c95863a044b700f2063b0b5875 (gix-fs-v0.23.0)