CVE-2024-51990CWE-22

Path traversal via crafted Git repositories in jj

Critical · published November 7, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-11-07T00:15Z
EPSS history
Timeline
  • 07 NOV 00:15Z
    Path traversal via crafted Git repositories in jj
    cvelistv5