CVE-2021-28955: 
NixOS vulnerability analysis and mitigation

git-bug before version 0.7.2 contained an Uncontrolled Search Path Element vulnerability (CVE-2021-28955). The vulnerability was discovered in March 2021 and affected the way the application searches for the git binary on Windows systems. This security issue could allow arbitrary code execution through malicious repositories (GitHub Advisory, RyotaK Advisory).

The vulnerability stems from how Windows and some other operating systems include the current directory in the default search path with priority over system-wide paths. When git-bug searches for the git binary, a malicious user could craft a git.bat command, commit it, and push it to a repository. Due to the search path priority, this malicious executable would take precedence over the legitimate git binary and be executed (GitHub Advisory).

The vulnerability allows attackers to achieve arbitrary code execution on affected systems through malicious repositories. This issue primarily affects Windows systems and other operating systems with misconfigured PATH settings (GitHub Advisory).

The vulnerability can be exploited by creating a malicious repository containing a crafted git.bat file. When users interact with this repository using git-bug, the malicious executable would be triggered instead of the legitimate git binary (GitHub Advisory).

The vulnerability was fixed in version 0.7.2 of git-bug. Users are strongly recommended to update to this version or later to mitigate the security risk. No alternative workarounds were provided (RyotaK Advisory).