gitoxide gix-fs CVE-2026-100419

Exploitation requires: (1) the victim to check out an attacker-controlled/malicious repository or tree using gitoxide's worktree checkout; (2) checkout performed in forced mode with overwrite_existing enabled, which triggers the deferred-symlink phase; (3) a filesystem supporting symlinks (the writeup uses std::os::unix::fs::symlink, i.e. Unix-like hosts); and (4) a crafted tree containing colliding symlink and directory entries sharing a leading component so that gix_fs::Stack::make_relative_path_current reuses the cached prefix and skips create_leading_directory's symlink_metadata/unlink check. Limiting factors that reduce real-world risk: attack vector is LOCAL (no remote/network trigger), it needs user interaction (the victim must initiate the checkout), attack complexity is HIGH plus an additional attack requirement (winning the prefix-reuse condition), and it depends on the non-default forced/overwrite checkout mode rather than a plain clone.

This is a genuine but conditionally-gated risk rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P) is internally consistent with the technical writeup: exploitation is LOCAL (the victim must check out an attacker-crafted repository), requires HIGH attack complexity plus a specific attack requirement (AT:P) because it depends on winning the prefix-reuse caching condition in gix_fs::Stack and on the checkout running in forced mode with overwrite_existing, and requires user interaction (UI:P - the victim initiating checkout). Impact is high (VC:H/VI:H/VA:H) because a worktree escape allowing arbitrary symlink/file writes (e.g. into .git/hooks or any writable directory) chains to code execution. No EPSS score, no CISA KEV listing, and no packaged proof-of-concept are present in the input, so this is 'no public exploit identified at time of analysis' - however, the GHSA advisory (GHSA-f89h-2fjh-2r9q) contains a detailed, near-reproducible exploitation recipe (duplicate symlink+directory tree entries → deferred symlink phase → symlink(target, '<wt>/a/post-checkout')), which materially lowers the barrier to weaponization. Note a version-scope conflict that must be resolved before remediation: the CVE description states 'before 0.23.0' while the GHSA/package data states vulnerable <= 0.21.0, fixed in 0.21.1, and the source reference cites the gix-fs-v0.22.1 tag - verify the true fixed version with the vendor. Net: real priority for anyone whose tooling force-checks-out untrusted repositories with gitoxide, but not an internet-facing drive-by; the AV:L + UI:P + AC:H combination keeps real-world exposure narrow.

An attacker publishes a malicious Git repository whose tree contains a symlink entry 'a' pointing to a sensitive directory (e.g. .git/hooks) plus a colliding directory 'a/' containing a symlink such as post-checkout. When a victim performs a forced checkout (overwrite_existing) of this repository using gitoxide, the deferred symlink phase reuses the cached 'a' prefix without re-running the intermediate-directory safety check, so a subsequent write resolves through the attacker's symlink and lands outside the worktree - e.g. writing an executable .git/hooks/post-checkout that runs on the next hook-aware Git operation. No packaged PoC is provided, but the GHSA advisory documents the full exploitation path in reproducible detail.