CVE-2023-53158: Gitoxidelabs Gix-Transport

Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days.

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

Affected products

• Gitoxidelabs Gix-Transport: before 0.36.1 (fixed in 0.36.1)

Published 2025-07-28. Last modified 2026-06-17.