gix

Rust / Cargo · Package

9 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()GHSA-Q54R-JF2P-RFR2	gix	Rust / Cargo	High	Fix reported	2026-10-24
gix traversal outside working tree enables arbitrary code executionCVE-2024-35186 · GHSA-7W47-3WG8-547CVersion ranges need review.	gitoxide-core gitoxide	Rust / Cargo	High	Fix reported	2026-10-12
gix refs and paths with reserved Windows device names access the devicesCVE-2024-35197 · GHSA-49JC-R788-3FC9Version ranges need review.	gitoxide-core gitoxide	Rust / Cargo	Medium	Fix reported	2026-10-12
gitoxide does not detect SHA-1 collision attacksCVE-2025-31130 · GHSA-2FRX-2596-X5R6Version ranges need review.	gitoxide-core gitoxide	Rust / Cargo	Medium	Fix reported	2026-10-12
gix-transport indirect code execution via malicious usernameCVE-2024-32884 · GHSA-98P4-XJMM-8MFHVersion ranges need review.	gitoxide gix-transport	Rust / Cargo	Medium	Fix reported	2026-10-12
gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repositoryCVE-2026-82252 · GHSA-PG4W-G64P-QWHJ	gitoxide gix	Rust / Cargo	High	Fix reported	2026-09-10
gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodulesCVE-2026-40034 · GHSA-F26G-JM89-4G65	gix	Rust / Cargo	High	Fix reported	2026-09-10
gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repositoryCVE-2026-82251 · GHSA-FR8X-3VFX-F45H	gitoxide gix	Rust / Cargo	High	Fix reported	2026-09-10
gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosureCVE-2026-82253 · GHSA-P3HW-MV63-RF9W	gix-validate gix	Rust / Cargo	High	Fix reported	2026-09-10