GitHub Advisoryadvisory · crates.io

GHSA-rrjw-j4m2-mf34 gix-transport code execution vulnerability

MEDIUM Published 2023-09-25 Modified 2025-07-28 Official page ↗
Aliases
CVE-2023-53158
Ecosystem
crates.io
Packages
gix-transport
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-78, CWE-88
Reviewed
2023-09-25

Affected packages

• crates.io gix-transport: < 0.36.1 → fixed in 0.36.1

Description

The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution. PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'` This will launch a calculator on OSX. See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`. Thanks for vin01 for disclosing this issue.

Related

Alias · CVE (1)

  • CVE-2023-53158 The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References