PT-2025-31032 · Unknown · Gix-Transport

Published 2023-09-23 · Updated 2025-07-28 · CVE-2023-53158

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions gix-transport crate versions prior to 0.36.1

Description The gix-transport crate contains a flaw that allows command execution through a crafted input string during a clone operation. Specifically, the vulnerability is triggered by the “gix clone 'ssh://-oProxyCommand=open$IFS” substring. This issue was identified before a similar vulnerability (CVE-2024-32884) involving a username field, which is considered more difficult to exploit.

Recommendations Update the gix-transport crate to version 0.36.1 or later.

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

AZL-66020

CVE-2023-53158

GHSA-5C5J-JMHX-Q2GR

GHSA-RRJW-J4M2-MF34

RUSTSEC-2023-0064

Affected Products

Gix-Transport

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2023-53158 · Security Note
• https://ubuntu.com/security/CVE-2023-53158 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53158 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66020 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5c5j-jmhx-q2gr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53158 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53158 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2023-0064 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrjw-j4m2-mf34 · Vendor Advisory
• https://github.com/GitoxideLabs/gitoxide · Note
• https://github.com/GitoxideLabs/gitoxide/pull/1032 · Note
• https://github.com/Byron/gitoxide · Note
• https://github.com/Byron/gitoxide/pull/1032 · Note
• https://crates.io/crates/gix-transport · Note
• https://github.com/advisories/GHSA-rrjw-j4m2-mf34 · Note