Relative Path Traversal in git-delta

published 2021-07-12 5 y ago modified 2026-06-17 4 mo ago also GHSA-5xg3-j2j6-rcx4 , RUSTSEC-2021-0105 , EUVD-2021-1584

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.

Patch / fix

fixed in 2 distros 1 links 2

crates.io git-delta 0.8.3
delta_project delta 0.8.3

git-delta openSUSE Tumbleweed 0.8.3-1.2

opensuse advisories openSUSE-SU-2024:10788-1

github.com/dandavison/delta@f01846b commit
github.com/dandavison/delta/releases/tag/0.8.3 release

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
crates.io	git-delta	<0.8.3 >=0.0.0-0, <0.8.3	0.8.3

Classification

Weakness

CWE-427 Uncontrolled Search Path Element
CWE-23 Relative Path Traversal

References

github.com /dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd
web, patch, third-party-advisory
vuln.ryotak.me /advisories/54
web, third-party-advisory
github.com /dandavison/delta/releases/tag/0.8.3
web, release-notes, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-36376
advisory, web
github.com /dandavison/delta
package
rustsec.org /advisories/RUSTSEC-2021-0105.html
web, advisory
crates.io /crates/git-delta
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary