Vulnerability · Published Nov 7, 2024 · Assigned by GitHub_M
CVE-2024-51990Path traversal via crafted Git repositories in jj
Critical 9.3
In plain English
A critical-severity path traversal in jj from martinvonz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.6%top 50.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| martinvonz | jj | < 0.23.0 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56 x_refsource_CONFIRM