GI
Vendor
GitoxideLabs
23
CVEs
0
On KEV
4
New 30D
Products
GI6.5
gix-pack
GitoxideLabs
3 CVEs0 on KEV3 new
GI4.3
gix-mailmap
GitoxideLabs
1 CVEs0 on KEV1 new
GI7.8
gitoxide
GitoxideLabs
16 CVEs0 on KEV0 new
GI7.1
Gix-date
Gitoxidelabs
1 CVEs0 on KEV0 new
GI7.8
Gix-fs
Gitoxidelabs
1 CVEs0 on KEV0 new
GI4.1
gix-transport
GitoxideLabs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109351 | GI gix-pack GitoxideLabs | 6.5 | Oct 12 | Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count |
| CVE-2026-109350 | GI gix-pack GitoxideLabs | 6.5 | Oct 12 | Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance |
| CVE-2026-109349 | GI gix-pack GitoxideLabs | 6.5 | Oct 12 | gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header |
| CVE-2026-109348 | GI gix-mailmap GitoxideLabs | 4.3 | Oct 12 | Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing |
| CVE-2026-100419 | GI gitoxide GitoxideLabs | 7.0 | Sep 25 | gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink |
| CVE-2026-91986 | GI gitoxide GitoxideLabs | 5.4 | Sep 15 | gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection |
| CVE-2025-24890 | GI gitoxide GitoxideLabs | 6.8 | Sep 14 | gix-sec safe.directory protections absent for elevated administrators |
| CVE-2026-82255 | GI gitoxide GitoxideLabs | 6.8 | Aug 28 | gitoxide 0.25.4 HTTP Credential Leak via Redirect |
| CVE-2026-82254 | GI gitoxide GitoxideLabs | 7.5 | Aug 28 | gitoxide before 0.69.0 Denial of Service via gix-pack |
| CVE-2026-82253 | GI gitoxide GitoxideLabs | 7.5 | Aug 28 | gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass |
| CVE-2026-82252 | GI gitoxide GitoxideLabs | 7.5 | Aug 28 | gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules |
| CVE-2026-82251 | GI gitoxide GitoxideLabs | 7.5 | Aug 28 | gitoxide before 0.52.1 Path Traversal via Submodule Name |
| CVE-2026-82250 | GI gitoxide GitoxideLabs | 6.5 | Aug 28 | gitoxide gix-packetline before 0.21.5 Denial of Service |
| CVE-2026-82249 | GI gitoxide GitoxideLabs | 3.1 | Aug 28 | gitoxide before 0.38.2 Credential Helper Protocol Field Injection |
| CVE-2026-82248 | GI gitoxide GitoxideLabs | 5.3 | Aug 28 | gitoxide before 0.33.0 Path Traversal via symlink following |
| CVE-2026-82247 | GI gitoxide GitoxideLabs | 7.5 | Aug 28 | gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing |
| CVE-2026-44471 | GI gitoxide GitoxideLabs | 7.8 | May 13 | gitoxide: Symlink prefix-reuse allows worktree escape during checkout |
| CVE-2026-0810 | GI gitoxide GitoxideLabs | 7.1 | Jan 26 | Gix-date: gix-date: undefined behavior due to invalid string generation |
| CVE-2023-53158 | GI gix-transport GitoxideLabs | 4.1 | Jul 28 | The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring |
| CVE-2025-31130 | GI gitoxide GitoxideLabs | 6.8 | Apr 4 | gitoxide does not detect SHA-1 collision attacks |
| CVE-2025-22620 | GI gitoxide GitoxideLabs | 5.0 | Jan 20 | gix-worktree-state nonexclusive checkout sets executable files world-writable |