CVE-2024-51990 — Path traversal via crafted Git repositories in jj

CVE-2024-51990

Path traversal via crafted Git repositories in jj PUBLISHED

Description (CNA)

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.

Affected (CNA)

Vendor / product	Versions
martinvonz / jj	affected < 0.23.0

CWE

CWE-22

References

https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.