Log in Start free

GitoxideLabs

Products

ProductCVEsExploitedLatest
gitoxide16–Sep 25, 2026
gix-pack3–Oct 12, 2026
gix-mailmap1–Oct 12, 2026
gix-transport1–Jul 28, 2025

Exploited and recent CVEs

  • CVE-2026-109351 Medium 6.5 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count 0.3%
  • CVE-2026-109350 Medium 6.5 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance 0.3%
  • CVE-2026-109349 Medium 6.5 gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header 0.3%
  • CVE-2026-109348 Medium 4.3 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing 0.3%
  • CVE-2026-100419 High 7.0 gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink 0.2%
  • CVE-2026-91986 Medium 5.4 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection 0.2%
  • CVE-2025-24890 Medium 6.8 gix-sec safe.directory protections absent for elevated administrators 0.2%
  • CVE-2026-82255 Medium 6.8 gitoxide 0.25.4 HTTP Credential Leak via Redirect 0.4%
  • CVE-2026-82254 High 7.5 gitoxide before 0.69.0 Denial of Service via gix-pack 0.5%
  • CVE-2026-82253 High 7.5 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass 0.7%
  • CVE-2026-82252 High 7.5 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules 0.5%
  • CVE-2026-82251 High 7.5 gitoxide before 0.52.1 Path Traversal via Submodule Name 0.5%
  • CVE-2026-82250 Medium 6.5 gitoxide gix-packetline before 0.21.5 Denial of Service 0.4%
  • CVE-2026-82249 Low 3.1 gitoxide before 0.38.2 Credential Helper Protocol Field Injection 0.3%
  • CVE-2026-82248 Medium 5.3 gitoxide before 0.33.0 Path Traversal via symlink following 0.3%
  • CVE-2026-82247 High 7.5 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing 0.4%
  • CVE-2026-44471 High 7.8 gitoxide: Symlink prefix-reuse allows worktree escape during checkout 0.3%
  • CVE-2026-0810 High 7.1 Gix-date: gix-date: undefined behavior due to invalid string generation 0.2%
  • CVE-2023-53158 Medium 4.1 The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnera 0.2%
  • CVE-2025-31130 Medium 6.8 gitoxide does not detect SHA-1 collision attacks 0.3%
  • CVE-2025-22620 Medium 5.0 gix-worktree-state nonexclusive checkout sets executable files world-writable 0.4%