gitoxide
- Software type
- Software library
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/05/2026, gitoxide recorded 12 security vulnerabilities in the last 90 days, of which 8 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of gitoxide and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123533Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph FileCVE-2026-123532gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC ProbeCVE-2026-100419gitoxide gix-fs before 0.23.0 Worktree Escape via SymlinkCVE-2026-91986gitoxide gix-transport before 0.59.2 CR/LF/NUL InjectionCVE-2025-24890gix-sec safe.directory protections absent for elevated administrators| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-123533Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-123532gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-100419gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink | Exploitation statusActively exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-91986gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityMedium |
|---|
CVE-2025-24890gix-sec safe.directory protections absent for elevated administrators | Exploitation statusActively exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via Redirect | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82254gitoxide before 0.69.0 Denial of Service via gix-pack | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82252gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82251gitoxide before 0.52.1 Path Traversal via Submodule Name | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82250gitoxide gix-packetline before 0.21.5 Denial of Service | Exploitation statusNot exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-82249gitoxide before 0.38.2 Credential Helper Protocol Field Injection | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityLow |
|---|
CVE-2026-82248gitoxide before 0.33.0 Path Traversal via symlink following | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityMedium |
|---|
CVE-2026-82247gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing | Exploitation statusActively exploited | FixYes | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-44471gitoxide: Symlink prefix-reuse allows worktree escape during checkout | Exploitation statusActively exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-0810Gix-date: gix-date: undefined behavior due to invalid string generation | Exploitation statusActively exploited | FixYes | Published01/26/2026 | SeverityHigh |
|---|
CVE-2025-31130gitoxide does not detect SHA-1 collision attacks | Exploitation statusActively exploited | FixYes | Published04/04/2025 | SeverityMedium |
|---|
CVE-2025-22620gix-worktree-state nonexclusive checkout sets executable files world-writable | Exploitation statusActively exploited | FixYes | Published01/20/2025 | SeverityMedium |
|---|
16 Results | Page 1 of 1