CVE-2023-53158
gix-transport code execution vulnerability
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
CVE-2023-53158- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-59769
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
EUVD-2023-59769- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rrjw-j4m2-mf34
gix-transport code execution vulnerability
The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.
PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.
Thanks for vin01 for disclosing this issue.
- Record
GHSA-rrjw-j4m2-mf34- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-78, CWE-88
- Updated
- 2026-11-02
NVD
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
CVE-2023-53158- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
CVE-2023-53158- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-rrjw-j4m2-mf34
gix-transport code execution vulnerability
The gix-transport crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading to arbitrary code execution.
PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.
Thanks for vin01 for disclosing this issue.
- Record
GHSA-rrjw-j4m2-mf34- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-78, CWE-88
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-53158
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
UBUNTU-CVE-2023-53158- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-66020 No score
CVE-2023-53158 affecting package rust for versions less than 1.72.0-8
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
- Record
AZL-66020- Updated
- 2026-11-02
OSVRUSTSEC-2023-0064 No score
gix-transport code execution vulnerability
The gix-transport crate prior to the patched version 0.36.1 would allow attackers to
use malicious ssh clone URLs to pass arbitrary arguments to the ssh program, leading
to arbitrary code execution.
PoC: gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'
This will launch a calculator on OSX.
See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in git.
Thanks to vin01 for disclosing the issue.
- Record
RUSTSEC-2023-0064- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gix-transportcrates.io |
before 0.36.1 | 0.36.1 |
rustAzure Linux:2 |
before 1.72.0-8 | 1.72.0-8 |
gix-transportcrates.io |
0.0.0-0 up to 0.36.1 | 0.36.1 |
rust-gix-transportUbuntu:24.04:LTS |
All versions, plus listed versions 0.41.1-10.41.1-1build1 |
None known |
rust-gix-transportUbuntu:25.10 |
All versions, plus listed versions 0.44.0-1 |
None known |
rust-gix-transportUbuntu:26.10 |
All versions, plus listed versions 0.48.0-10.57.0-1 |
None known |
rust-gix-transportUbuntu:26.04:LTS |
All versions, plus listed versions 0.44.0-10.48.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-53158 is a medium vulnerability (CVSS 4.1) in Gitoxidelabs Gix-transport, published September 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in gix-transport 0.36.1.