CVE-2023-53158
Medium
Description
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
SeverityMedium
CVSS4.1
Exploit probability—
ProductGitoxidelabs Gix-transport
PublishedJul 28, 2025
First seenJul 28, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- GitoxideLabs gix-transport0.36.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GitoxideLabs gix-transport | v < 0.36.1 | 0.36.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.