Gitoxidelabs Gitoxide
12 CVEs affecting Gitoxidelabs Gitoxide. Latest disclosed: 2026-08-28. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44471 | High | 7.8 | 2026-05-13 | gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit wr… |
CVE-2026-82254 | High | 7.5 | 2026-08-28 | gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attack… |
CVE-2026-82253 | High | 7.5 | 2026-08-28 | gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate… |
CVE-2026-82252 | High | 7.5 | 2026-08-28 | gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadat… |
CVE-2026-82251 | High | 7.5 | 2026-08-28 | gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attac… |
CVE-2026-82247 | High | 7.5 | 2026-08-28 | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, cont… |
CVE-2026-0810 | High | 7.1 | 2026-01-26 | A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates… |
CVE-2025-31130 | Medium | 6.8 | 2025-04-04 | gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulne… |
CVE-2026-82250 | Medium | 6.5 | 2026-08-28 | gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines w… |
CVE-2026-82248 | Medium | 5.3 | 2026-08-28 | gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing te… |
CVE-2025-22620 | Medium | 5.0 | 2025-01-20 | gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intend… |
CVE-2026-82249 | Low | 3.1 | 2026-08-28 | gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carri… |