CVE-2026-44471
Description
gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In gitoxide before 0.21.1, a crafted tree can bypass directory validation during checkout, allowing an attacker to write a symlink into an arbitrary writable directory.
Vulnerability
Overview
CVE-2026-44471 is a high-severity vulnerability in gitoxide, a Rust implementation of Git, affecting versions prior to 0.21.1. The flaw lies in the checkout process, where symlink index entries are deferred and created after regular files using a shared gix_worktree::Stack. Internally, gix_fs::Stack::make_relative_path_current() caches validated path prefixes; when a previously processed leaf component matches the leading component(s) of the next path, the leaf-to-directory transition invokes only delegate.push_directory(), skipping delegate.push() [1][2]. In StackDelegate, when the state is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes and does not perform the on-disk symlink_metadata() check or unlink-on-collision that normally occur in StackDelegate::push() via create_leading_directory() [1][3]. This bypass allows an attacker to construct a malicious tree that, when checked out, writes an attacker-controlled symlink into any existing directory the user has write access to [1][2].
Exploitation
An attacker can craft a Git tree with duplicate entries: a symlink entry (e.g., a pointing to .git/hooks) and a directory entry a containing a symlink post-checkout pointing to ../../payload, plus an executable file payload. During checkout, the index entries become ["a" (SYMLINK), "a/post-checkout" (SYMLINK)]. In the delayed symlink phase, a is created as a symlink to .git/hooks. When processing a/post-checkout, the a prefix is reused from the just-processed leaf entry without re-running the intermediate-directory check. The final symlink() call resolves through the attacker-controlled symlink, writing the payload to .git/hooks/post-checkout [2][3].
Impact
Successful exploitation allows an attacker to write a symlink into any directory the user has write access to, potentially enabling arbitrary code execution (e.g., by placing a malicious Git hook in .git/hooks). The vulnerability is rated High with a CVSS v3 score of 7.8 [1].
Mitigation
The vulnerability is fixed in gitoxide version 0.21.1. Users should upgrade immediately. No workarounds are documented, and the issue is not currently listed in CISA's Known Exploited Vulnerabilities catalog [1][2][3].
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gix-fscrates.io | < 0.21.1 | 0.21.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.