{"id":"ghsa-ghsa-q54r-jf2p-rfr2","seq":661329,"kind":"advisory","title":"gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()","url":"https://github.com/advisories/GHSA-q54r-jf2p-rfr2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q54r-jf2p-rfr2","summary":"影響: rust:gix >= 0.88.0, <= 0.89.0 → 0.90.0\nIn the gix crate, Cache::protect_options() in gix/src/config/cache/access.rs reads the three filesystem path-protection settings (core.protectHFS, core.protectNTFS, and gitoxide.core.protectWindows) with the unfiltered gix_config::File::boolean() accessor instead of the trust-aware boolean_filter() accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps .git/config sections to Trust::Reduced),…","severity":"high","techs":["rust"],"cves":[],"tags":["GHSA-q54r-jf2p-rfr2","gix"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:52:28.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}