Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
GitoxideLabs gix-pack versions before 0.75.0 contain a denial of service vulnerability. This flaw allows malicious remote repositories to crash fetch operations by sending specially crafted thin-pack OFS_DELTA entries. The vulnerability triggers a panic in the LookupRefDeltaObjectsIter function, aborting the fetch process and causing a denial of service.
A reachable assertion vulnerability exists in GitoxideLabs gix-pack versions before 0.75.0. The vulnerability arises because the pack header decoder accepts version 3, but an assertion in the code requires version 2, causing a panic when a malicious remote sends a version 3 pack header. This can abort clone or fetch operations.
GitoxideLabs gix-mailmap versions before 0.35.0 contain a denial of service vulnerability due to inefficient quadratic-time parsing in the Snapshot::from_bytes function. An attacker can craft a .mailmap file with descending-ordered entries that cause repeated front inserts, exhausting CPU resources and blocking operations like log, blame, or shortlog for several minutes. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.
gitoxide gix-fs versions before 0.23.0 have a path validation bypass vulnerability in the worktree checkout mechanism. This flaw allows attackers to escape the intended worktree directory by manipulating symbolic links during forced checkouts with overwrite_existing enabled. Malicious repository trees can replace validated directories with symlink entries, causing files to be written outside the worktree, potentially enabling code execution or file manipulation.
CVE-2026-91986 is a medium severity injection vulnerability in GitoxideLabs gitoxide affecting versions before 0.59.2. The gitoxide gix-transport component does not properly filter control characters in git-daemon connect requests, allowing injection of NUL, CR, and LF bytes via crafted git URLs. This can enable spoofing of virtual hosts or insertion of newlines into daemon requests and logs.
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator's privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3.
gitoxide versions from 0.25.4 through 0.55.0 have an HTTP credential leak vulnerability in the curl-based transport backend. The flaw causes credentials to be sent to attacker-controlled servers after HTTP redirects because the validation checks the original URL rather than the effective URL after redirect. This allows attackers to steal authentication tokens via cross-domain redirects or HTTPS-to-HTTP downgrades.
CVE-2026-82254 is a high-severity vulnerability in gitoxide before version 0.69.0. It allows attackers to cause uncaught exceptions and out-of-memory conditions by sending crafted pack data during clone or fetch operations. The issue arises from unchecked array indexing and uncapped memory allocation in the gix-pack component, triggered by attacker-controlled size headers.
gitoxide gix-packetline versions before 0.21.5 contain an integer underflow vulnerability that causes a panic in the TextRef implementation when processing side-band packet lines with empty payloads. A malicious Git server can exploit this by sending a crafted side-band packet, triggering an index out of bounds panic that aborts the client process during fetch operations without requiring authentication.
gitoxide versions before 0.38.2 contain a vulnerability where carriage return characters in URL values passed to credential helpers are not properly validated. This flaw allows attackers to inject additional helper protocol fields, potentially causing credential helpers to return credentials for attacker-specified hosts instead of the intended URL. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-82248 is a medium severity vulnerability in gitoxide's gix-worktree-state component before version 0.33.0. It allows writing files outside the intended worktree on Windows due to improper handling of symbolic links during incremental checkouts when core.symlinks is enabled. Specifically, a symlink pointing outside the worktree can be followed during a subsequent checkout, causing overwriting of files outside the worktree.
gitoxide versions prior to 0.82.0 and gix-validate versions prior to 0.11.1 contain a path traversal vulnerability in submodule name validation. The validation only checks the first occurrence of '..', allowing crafted names to bypass checks. Additionally, the validation is not invoked in production code. This flaw combined with a trust inheritance issue in Submodule::open() allows an attacker to craft malicious .gitmodules files that cause victim tools to read arbitrary git repository configurations with full trust, bypassing safe-directory protections. The vulnerability is fixed in gix 0.82.0 and gix-validate 0.11.1.
CVE-2026-82252 is a high-severity vulnerability in gitoxide before version 0.52.1 where symbolic links in the .gitmodules file are improperly resolved. This allows an attacker to cause gitoxide to parse external files as submodule metadata, potentially injecting malicious submodule configuration values.
CVE-2026-82251 is a path traversal vulnerability in gitoxide before version 0.52.1. It arises from improper validation of submodule names in the .gitmodules configuration, allowing attackers to use traversal segments to redirect file operations outside the intended repository directory. This can cause repository confusion and enable inspection of attacker-controlled repositories. The vulnerability has a high severity with a CVSS score of 8.7.
CVE-2026-82247 is a high-severity vulnerability in GitoxideLabs' gitoxide project affecting the gix-url crate (<= 0.32.0) and gix-transport (<= 0.49.0). The issue arises from a non-compliant URL parser that mishandles the authority component, allowing an attacker to craft malicious HTTP redirect responses. This flaw causes gitoxide to send HTTP Basic Authorization credentials to an unintended host, potentially exposing sensitive credentials. Fixes are available in gix-url 0.37.1 and gix-transport 0.58.1.
gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: when the previously-processed leaf component exactly matches the leading component(s) of the next path, the leaf-to-directory transition at gix-fs/src/stack.rs invokes only delegate.push_directory(), never delegate.push(). In gix_worktree::stack::delegate::StackDelegate, when the state member is State::CreateDirectoryAndAttributesStack, Attributes::push_directory() only loads attributes (from the ODB, in the clone case), and does not perform any other checks. The on-disk symlink_metadata() check and unlink-on-collision live in StackDelegate::push()'s invocation of create_leading_directory(), which is therefore bypassed for the cached prefix. The final symlink is created with plain std::os::unix::fs::symlink, which follows symlinks in parent directories. Therefore, it's possible to provide a tree with duplicate symlink and directory entries that exploits this. This vulnerability is fixed in 0.21.1.
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks.gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.