{
  "verdict": "confirmed",
  "cve": "CVE-2026-44471",
  "ghsa": "GHSA-f89h-2fjh-2r9q",
  "cwe": "CWE-59",
  "package": "gix-fs",
  "vulnerable_version": "gix-fs 0.21.0",
  "fixed_version": "gix-fs 0.21.1",
  "vulnerable_indicator": {
    "description": "file escaped worktree to forbidden directory",
    "exit_code": 0,
    "log_path": "logs/vulnerable.log",
    "observable": "A file named 'file' was created in the forbidden directory outside the worktree, and a symlink 'link' pointing to the forbidden directory was created inside the worktree."
  },
  "fixed_indicator": {
    "description": "symlink collision blocked, no escape",
    "exit_code": 1,
    "log_path": "logs/fixed.log",
    "observable": "No file was created in the forbidden directory. The checkout blocked the malicious symlink entry, preventing worktree escape."
  },
  "summary": "CONFIRMED: Symlink worktree escape reproduced on vulnerable version (gix-fs 0.21.0) and blocked on fixed version (gix-fs 0.21.1).",
  "timestamp": "2026-05-22T18:32:00Z"
}