Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-53158

Good to know:

icon

Date: July 27, 2025

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

Severity Score

Related Resources (9)

https://github.com/GitoxideLabs/gitoxide
https://nvd.nist.gov/vuln/detail/CVE-2023-53158
https://github.com/GitoxideLabs/gitoxide/pull/1032
https://crates.io/crates/gix-transport
https://rustsec.org/advisories/RUSTSEC-2023-0064.html
https://github.com/advisories/GHSA-rrjw-j4m2-mf34
https://secure.phabricator.com/T12961
https://github.com/Byron/gitoxide/pull/1032
https://www.mend.io/vulnerability-database/CVE-2023-53158

Severity Score

Weakness Type (CWE)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-88

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

Top Fix

icon

Upgrade Version

Upgrade to version gix-transport - 0.36.1;https://github.com/GitoxideLabs/gitoxide.git - gix-transport-v0.36.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us