CVE-2026-44471: gix-fs: Symlink prefix-reuse allows worktree escape during checkout

May 7, 2026 (updated May 14, 2026)

A malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to.

References

github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f89h-2fjh-2r9q
github.com/advisories/GHSA-f89h-2fjh-2r9q
nvd.nist.gov/vuln/detail/CVE-2026-44471

Code Behaviors & Features

Detect and mitigate CVE-2026-44471 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →