Critical severityOSV Advisory· Published Nov 7, 2024· Updated Apr 15, 2026

CVE-2024-51990

Description

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
jj-libcrates.io	< 0.23.0	0.23.0

Affected products

Martinvonz/JjOSV
Range: v0.10.0, v0.11.0, v0.12.0, …
ghsa-coords2 versions
pkg:cargo/jj-lib pkg:rpm/opensuse/jujutsu&distro=openSUSE%20Tumbleweed
< 0.23.0+ 1 more
- (no CPE)range: < 0.23.0
- (no CPE)range: < 0.23.0-1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-88h5-6w7m-5w56ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-51990ghsaADVISORY
github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000