VDB
CVE-2024-51990
CVE-2024-51990
PUBLISHED
CVSS 9.300000190734863 CRITICAL
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
EPSS 0.61% · 47.0th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.61%
47.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| martinvonz | jj | < 0.23.0, < 0.23.0 |
| martinvonz | jj | 0, 0 |
| crates.io | jj-lib | 0, 0 |
Timeline
- Jan 21, 1970 Security Advisory
- Nov 7, 2024 CVE Published
- Nov 7, 2024 EPSS Score
- Nov 7, 2024 Coalition ESS Score
- Nov 7, 2024 PoC Published
- Nov 7, 2024 PoC Published
- Nov 8, 2024 Coalition ESS Score
- Nov 25, 2024 EPSS Score
- Dec 14, 2024 EPSS Score
- Jan 1, 2025 EPSS Score
- Jan 19, 2025 EPSS Score
- Feb 7, 2025 EPSS Score