{"id":"CVE-2024-51990","aliases":["GHSA-88h5-6w7m-5w56"],"url":"https://o3.security/vulnerability/CVE-2024-51990","summary":"Path traversal via crafted Git repositories in jj","details":"jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.","published":"2024-11-07T00:15:17.443Z","modified":"2026-07-15T01:48:57.197432072Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"jj-lib","fixedVersion":"0.23.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51990.json"},{"type":"ADVISORY","url":"https://github.com/martinvonz/jj/security/advisories/GHSA-88h5-6w7m-5w56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51990"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:57.197432072Z"}}