Description
dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git-delta | 0.8.3-1.2 | openSUSE-SU-2024:10788-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | git-delta | < 0.8.3 | 0.8.3 | GHSA-5xg3-j2j6-rcx4 |
| crates.io | git-delta | >= 0.0.0-0, < 0.8.3 | 0.8.3 | RUSTSEC-2021-0105 |
Advisories 1
- openSUSE-SU-2024:10788-1 git-delta-0.8.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026