CVE-2024-43785 - CVE House
Back to Database
Status published Low CVE-2024-43785

gitoxide-core does not neutralize special characters for terminals

Vulnerability Description

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43785

Credits & Attribution

No credits recorded in the NVD database.

References

More from Byron

View All →
CVE-2024-45405
gix-path improperly resolves configuration path reported by Git
Medium 6
CVE-2024-45305
gix-path uses local config across repos when it is the highest scope
Low 2.5
CVE-2024-40644
gitoxide's gix-path can use a fake program files location
Medium 6.8
CVE-2024-35197
gix refs and paths with reserved Windows device names access the devices
Medium 5.4
CVE-2024-35186
gix traversal outside working tree enables arbitrary code execution
High 8.8

Affected Vendor

Affected Software

gitoxide
Vulnerable Versions:
<= 0.41.0

Timeline

Official Publish: August 22nd, 2024
Last Modified: August 22nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-150

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.