The vulnerability resides in gix-fs within gitoxide prior to version 0.24.1. This is a directory traversal vulnerability (CWE-59). It allows a remote attacker to cause a victim’s Windows machine to perform SMB authentication against the attacker’s server by creating a UNC symlink in a malicious repository. When the victim checks out the repository with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, which triggers SMB authentication and leaks the victim’s username, domain, and NTLMv2 hash. The exploitation results in the disclosure of authenticating credentials without any local code execution on the victim’s side.

GitoxideLabs gitoxide users running a version earlier than 0.24.1 are affected. The vulnerability applies to all platforms where gitoxide is run on Windows and the symlinks feature is enabled.

With a CVSS score of 7.1 and no EPSS data, the risk is moderate to high. The vulnerability is not listed in the CISA KEV catalog. Attacks are feasible when a Windows host pulls or checks out a malicious repository containing a UNC symlink. The attacker must provide the crafted repository; the victim’s Windows client must have symlinks enabled and be configured to allow SMB authentication. No additional exploitation conditions are required beyond normal repository access.