{"id":"GHSA-cx7h-h87r-jpgr","aliases":["RUSTSEC-2024-0359"],"url":"https://o3.security/vulnerability/GHSA-cx7h-h87r-jpgr","summary":"The kstring integration in gix-attributes is unsound","details":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `&str` from a `&[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `&str` and relies on it being UTF-8 in the `&str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `&str`.\n","published":"2024-07-25T16:38:42Z","modified":"2026-09-10T03:50:16.580555746Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"gix-attributes","fixedVersion":"0.22.3"}],"fix":{"url":"https://github.com/rustsec/advisory-db/commit/884aaa1646132bc3a27ba058197d6ef039bec294","label":"rustsec/advisory-db@884aaa1"},"references":[{"type":"WEB","url":"https://github.com/Byron/gitoxide/issues/1460"},{"type":"WEB","url":"https://github.com/GitoxideLabs/gitoxide/issues/1460"},{"type":"WEB","url":"https://github.com/rustsec/advisory-db/commit/884aaa1646132bc3a27ba058197d6ef039bec294"},{"type":"PACKAGE","url":"https://github.com/Byron/gitoxide"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0359.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:16.580555746Z"}}