Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck

CVE-2026-100419gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

High 7.0

In plain English

A high-severity security flaw in gitoxide from GitoxideLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 87.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rust-gix-fs	no fix listed	DEBIAN-CVE-2026-100419
Debian:14	rust-gix-fs	no fix listed	DEBIAN-CVE-2026-100419
Ubuntu:24.04:LTS	rust-gix-fs	no fix listed	UBUNTU-CVE-2026-100419
Ubuntu:26.04:LTS	rust-gix-fs	no fix listed	UBUNTU-CVE-2026-100419
Ubuntu:26.10	rust-gix-fs	no fix listed	UBUNTU-CVE-2026-100419

Affected products (as reported)

Vendor	Product	Versions
GitoxideLabs	gitoxide	0 – before 0.23.0

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-6p9q-f2xg-6pr5) vendor-advisory
Patch Commit patch
gix-fs 0.22.1 stack.rs pop loop and disarmed guard technical-description
GitHub Security Advisory (GHSA-f89h-2fjh-2r9q) related, vendor-advisory
https://github.com/GitoxideLabs/gitoxide product
VulnCheck Advisory: gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink third-party-advisory