Reported

July 12, 2021

Issued

September 9, 2021 (last modified: September 10, 2021)

Package

git-delta (crates.io)

Type

Vulnerability

Categories

• file-disclosure

Aliases

• CVE-2021-36376
• GHSA-5xg3-j2j6-rcx4

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-36376

CVSS Score

7.8 HIGH

CVSS Details

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Patched

• >=0.8.3

Affected OSes

• windows

Description

git-delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.

Advisory available under CC0-1.0 license.