Zero Radar
← feed
HighVulnerabilityGHSA-q54r-jf2p-rfr2updated 25 Oct 2026, 13:32 UTC

gix (Rust Git library) can be tricked into disabling .git path protection

A malicious repository on a shared computer can switch off a safety check in gix. That check normally stops files from being written into the hidden .git folder, which could then let an attacker plant hooks or config changes.

Fixed in gix 0.90.0Official source
SeverityHighCVSS 7.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgix 0.90.0 · since 25 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Malicious repo ownerControls .git/config on shared disk
  2. 2Sets protectNTFS=falseUntrusted local config is honored
  3. 3Victim opens repogix reads protection flags unfiltered
  4. 4Path checks disabledCrafted entries map to .git
  5. 5Hooks overwrittenFiles in .git are replaced
  6. ResultAttacker plants hooks or config in .git

What happened

In the gix crate, Cache::protect_options() reads core.protectHFS, core.protectNTFS and gitoxide.core.protectWindows without the trust filter, so untrusted repository-local .git/config values override the safe defaults.

Why it is dangerous: On case-insensitive filesystems, crafted tree entries can resolve to the .git directory and overwrite hooks or config, enabling code execution or repository tampering for the victim who opens the repository.

Are you affected?

You are affected if you use gix versions 0.88.0 through 0.89.0 to open repositories that may be owned by another user, such as on shared hosts, network-mounted checkouts, or reused CI workspaces.

Package / productAffected versionsFixed in
gix · rust>= 0.88.0, <= 0.89.00.90.0

What to do

  1. Update the gix crate to version 0.90.0 or later
  2. Rebuild and redeploy any tools that depend on gix
  3. Avoid opening untrusted repositories from shared filesystems until updated

Timeline

  1. 23 Oct 2026, 20:52 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:52 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-q54r-jf2p-rfr2
CVSS
7.3 / 10
Disclosed
23 Oct 2026, 20:52 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

gix (Rust Git library) can be tricked into disabling .git path protection · Zero Radar