GitoxideLabs gitoxide
16 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-100419 | < 0.23.0 | gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink | HIGH 7.3 | 0.2 % | ||
| CVE-2026-91986 | < 0.59.2 | gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-24890 | < 0.13.3 | gix-sec safe.directory protections absent for elevated administrators | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-82255 | 0.25.4 – 0.55.0 | gitoxide 0.25.4 HTTP Credential Leak via Redirect | HIGH 7.6 | 0.4 % | ||
| CVE-2026-82254 | < 0.69.0 | gitoxide before 0.69.0 Denial of Service via gix-pack | HIGH 8.7 | 0.5 % | ||
| CVE-2026-82253 | < 0.82.0 | gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass | HIGH 8.7 | 0.7 % | ||
| CVE-2026-82252 | < 0.52.1 | gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules | HIGH 8.7 | 0.5 % | ||
| CVE-2026-82251 | < 0.52.1 | gitoxide before 0.52.1 Path Traversal via Submodule Name | HIGH 8.7 | 0.5 % | ||
| CVE-2026-82250 | < 0.21.5 | gitoxide gix-packetline before 0.21.5 Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-82249 | < 0.38.2 | gitoxide before 0.38.2 Credential Helper Protocol Field Injection | LOW 2.3 | 0.3 % | ||
| CVE-2026-82248 | < 0.33.0 | gitoxide before 0.33.0 Path Traversal via symlink following | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-82247 | < 0.37.1 | gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing | HIGH 8.7 | 0.4 % | ||
| CVE-2026-44471 | < 0.21.1 | gitoxide: Symlink prefix-reuse allows worktree escape during checkout | HIGH 7.8 | 0.3 % | ||
| CVE-2026-0810 | < 0.12.0 | Gix-date: gix-date: undefined behavior due to invalid string generation | HIGH 7.1 | 0.2 % | ||
| CVE-2025-31130 | < 0.42.0 | gitoxide does not detect SHA-1 collision attacks | MEDIUM 6.8 | 0.3 % | ||
| CVE-2025-22620 | < 0.17.0 | gix-worktree-state nonexclusive checkout sets executable files world-writable | MEDIUM 5.0 | 0.4 % |