Command Execution Vulnerability in gix-transport for Rust
CVE-2023-53158

4.1MEDIUM

Key Information:

Vendor

Gitoxidelabs

Status
Gix-transport
Vendor
CVE Published:
28 July 2025

What is CVE-2023-53158?

The gix-transport crate prior to version 0.36.1 for Rust contains a vulnerability that allows attackers to execute arbitrary commands. This is achieved through the improper handling of the command syntax, specifically with the use of 'gix clone ssh://-oProxyCommand=open$IFS'. This vulnerability presents a significant risk to applications utilizing gix-transport, enabling potential unauthorized command execution in vulnerable environments.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

gix-transport 0 < 0.36.1

References

https://rustsec.org/advisories/RUSTSEC-2023-0064.html
https://github.com/GitoxideLabs/gitoxide/pull/1032
https://github.com/advisories/GHSA-rrjw-j4m2-mf34

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.