Security advisories

high2026-10-23

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

GHSA-q54r-jf2p-rfr2

medium2026-09-09

gix-sec safe.directory protections absent for elevated administrators

GHSA-7rhf-42qf-vrvc · CVE-2025-24890

medium2026-08-28

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

GHSA-2vh6-hw4j-32ww

high2026-05-07

gix-fs: Symlink prefix-reuse allows worktree escape during checkout

GHSA-f89h-2fjh-2r9q · CVE-2026-44471

high2026-05-05

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

GHSA-fr8x-3vfx-f45h

high2026-05-05

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

GHSA-pg4w-g64p-qwhj

high2026-05-05

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

GHSA-x494-mj8g-cj27

high2026-05-05

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

GHSA-f26g-jm89-4g65 · CVE-2026-40034

high2026-05-05

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

GHSA-p3hw-mv63-rf9w

medium2026-05-05

gix-transport: HTTP credentials leaked to redirected host in curl backend

GHSA-9857-6mw7-fq2m

medium2026-01-05

gix-date can create non-utf8 string with `TimeBuf::as_str`

GHSA-6mw6-mj76-grwc · CVE-2026-0810

medium2025-04-04

gitoxide does not detect SHA-1 collision attacks

GHSA-2frx-2596-x5r6 · CVE-2025-31130

medium2025-01-21

gix-worktree-state nonexclusive checkout sets executable files world-writable

GHSA-fqmf-w4xh-33rh · CVE-2025-22620

medium2023-09-25

gix-transport code execution vulnerability

GHSA-rrjw-j4m2-mf34 · CVE-2023-53158