RUSTSEC-2024-0359: The kstring integration in gix-attributes is unsound

What to do

1. See which version you have: cargo tree -i gix-attributes (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p gix-attributes. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example gix-attributes = "0.22.3") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB:

// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.

The problem is that the non-UTF8 str **is** exposed to outside code: first to the kstring crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to serde, where it propagates to e.g. serde_json, serde_yaml, etc., where the same problems occur.

This is not sound, and it could cause further UB down the line in these places that can view the &str.

*Thanks to Devin Jeanpierre for discovering and reporting this issue.*

References

• Package: crates.io/crates/gix-attributes
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0359.html
• Report: github.com/GitoxideLabs/gitoxide/issues/1460

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.