VDB
CVE-2024-51990
CVE-2024-51990
PUBLISHED
CVSS 9.300000190734863 CRITICAL
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from unknown sources.
EPSS 0.61% · 49.2th percentile
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.61%
49.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| martinvonz | jj | < 0.23.0, < 0.23.0 |
| martinvonz | jj | 0, 0 |
| crates.io | jj-lib | 0, 0 |
Timeline
- Jan 21, 1970 Security Advisory
- Nov 7, 2024 CVE Published
- Nov 7, 2024 EPSS Score
- Nov 7, 2024 Coalition ESS Score
- Nov 7, 2024 PoC Published
- Nov 7, 2024 PoC Published
- Nov 8, 2024 Coalition ESS Score
- Nov 26, 2024 EPSS Score
- Dec 16, 2024 EPSS Score
- Jan 3, 2025 EPSS Score
- Jan 22, 2025 EPSS Score
- Feb 10, 2025 EPSS Score