gix (crates.io)
Advisories
10
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.90.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p gix --precise 0.90.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-q54r-jf2p-rfr2 gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() |
High | >= 0.88.0, < 0.90.0 | 0.90.0 |
| GHSA-m4f9-c775-wg56 Duplicate Advisory: gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules Withdrawn |
High | >= 0.31.0, < 0.83.0 | 0.83.0 |
| GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository |
High EPSS 0.52% |
< 0.83.0 | 0.83.0 |
| GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository |
High EPSS 0.52% |
< 0.83.0 | 0.83.0 |
| GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules |
High EPSS 0.65% |
>= 0.31.0, < 0.83.0 | 0.83.0 |
| GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure |
High EPSS 0.66% |
< 0.83.0 | 0.83.0 |
| GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks |
Medium EPSS 0.26% |
< 0.71.0 | 0.71.0 |
| GHSA-49jc-r788-3fc9 gix refs and paths with reserved Windows device names access the devices |
Medium EPSS 0.45% |
< 0.63.0 | 0.63.0 |
| GHSA-7w47-3wg8-547c gix traversal outside working tree enables arbitrary code execution |
High EPSS 0.82% |
< 0.63.0 | 0.63.0 |
| GHSA-98p4-xjmm-8mfh gix-transport indirect code execution via malicious username |
Medium EPSS 0.51% |
< 0.62 | 0.62 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor