# gitoxide (crates.io) vulnerabilities 7 known vulnerabilities (3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.61.0 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 0.61.0 (Oct 22, 2026), the latest release - Weekly downloads: 113 - Dependents: 0 - Releases: 69 since 0.1.0 (Jul 12, 2020) - Registry: https://crates.io/crates/gitoxide - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-82252: 0.1.0 to 0.52.0 (0.52.1 is outside it) - CVE-2026-82251: 0.1.0 to 0.52.0 (0.52.1 is outside it) - CVE-2025-31130: 0.1.0 to 0.41.0 (0.42.0 is outside it) - CVE-2024-43785: 0.1.0 to 0.41.0 (0.42.0 is outside it) - CVE-2024-35197: 0.1.0 to 0.35.0 (0.36.0 is outside it) - CVE-2024-35186: 0.1.0 to 0.35.0 (0.36.0 is outside it) - CVE-2024-32884: 0.1.0 to 0.34.0 (0.35.0 is outside it) ## Advisories (7) ### [CVE-2026-82252](https://cve.now/CVE-2026-82252): gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 0.52.1. - Fixed in 0.52.1 (released Apr 24, 2026, 126 days before disclosure). - The latest release, 0.61.0, is not affected. ### [CVE-2026-82251](https://cve.now/CVE-2026-82251): gitoxide before 0.52.1 Path Traversal via Submodule Name - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 0.52.1. - Fixed in 0.52.1 (released Apr 24, 2026, 126 days before disclosure). - The latest release, 0.61.0, is not affected. ### [CVE-2025-31130](https://cve.now/CVE-2025-31130): gitoxide does not detect SHA-1 collision attacks - Severity: Medium 6.8 - Published: Apr 4, 2025 - Affected: fixed in 0.42.0. - Fixed in 0.42.0 (released Apr 4, 2025, the day of disclosure). - The latest release, 0.61.0, is not affected. ### [CVE-2024-43785](https://cve.now/CVE-2024-43785): gitoxide-core does not neutralize special characters for terminals - Severity: Low 2.5 - Published: Aug 22, 2024 - Affected: through 0.41.0. - Fixed in 0.42.0 (released Apr 4, 2025, 225 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.61.0, is not affected. ### [CVE-2024-35197](https://cve.now/CVE-2024-35197): gix refs and paths with reserved Windows device names access the devices - Severity: Medium 5.4 - Published: May 23, 2024 - Affected: fixed in 0.36.0. - Fixed in 0.36.0 (released May 22, 2024, 1 day before disclosure). - The latest release, 0.61.0, is not affected. ### [CVE-2024-35186](https://cve.now/CVE-2024-35186): gix traversal outside working tree enables arbitrary code execution - Severity: High 8.8 - Published: May 23, 2024 - Affected: fixed in 0.36.0. - Fixed in 0.36.0 (released May 22, 2024, 1 day before disclosure). - The latest release, 0.61.0, is not affected. ### [CVE-2024-32884](https://cve.now/CVE-2024-32884): gix-transport indirect code execution via malicious username - Severity: Medium 6.4 - Published: Apr 26, 2024 - Affected: fixed in 0.35. - Fixed in 0.35.0 (released Apr 13, 2024, 13 days before disclosure). - The latest release, 0.61.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/gitoxide Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.