IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2024-11-07 01:15

MODIFIED

2024-11-08 19:01

EPSS (Prob. Exploit)

0.62%

Top 50.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-88h5-6w7m-5w56 CRITICAL

jj vulnerable to path traversal via crafted Git repositories

AFFECTED PACKAGES:

RUST / jj-lib

< 0.23.0

Fixed in: 0.23.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Path traversal via crafted Git repositories in jj

AFFECTED PACKAGES:

Unknown / Unknown

26 versions affected

ALIASES:

GHSA-88h5-6w7m-5w56

> HISTORIQUE DES MODIFICATIONS

Première apparition

07/11/2024 01:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 14:56

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui