CVE-2023-53158

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

Score

CVSS 3.1 4.1 Medium

Status

Deferred - cve@mitre.org

Published

2025-07-28

Last modified

2025-07-28

Weaknesses

CWE-78

Affected products

• Gix-transport (Gitoxidelabs)

References

• https://crates.io/crates/gix-transport
• https://github.com/GitoxideLabs/gitoxide/pull/1032
• https://github.com/advisories/GHSA-rrjw-j4m2-mf34
• https://rustsec.org/advisories/RUSTSEC-2023-0064.html