- Latest release
- 0.90.0 (Oct 22, 2026): no advisory affects it
- Newest unaffected release
- 0.90.0 (Oct 22, 2026), the latest release
- Advisories
- 8 · 5 high, 3 medium
- Weekly downloads
- 1M
- Dependents
- 0
- Releases
- 75 since 0.0.0 (Feb 10, 2023)
- Registry
- crates.io
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-82253Affects 0.0.0 to 0.82.0 (0.83.0 is outside it)
- CVE-2026-82252Affects 0.0.0 to 0.82.0 (0.83.0 is outside it)
- CVE-2026-82251Affects 0.0.0 to 0.82.0 (0.83.0 is outside it)
- CVE-2026-40034Affects 0.35.0 to 0.82.0 (0.83.0 is outside it)
- CVE-2025-31130Affects 0.0.0 to 0.70.0 (0.71.0 is outside it)
- CVE-2024-35197Affects 0.0.0 to 0.62.0 (0.63.0 is outside it)
- CVE-2024-35186Affects 0.0.0 to 0.62.0 (0.63.0 is outside it)
- CVE-2024-32884Affects 0.0.0 to 0.61.1 (0.62.0 is outside it)
Advisories 8
- CVE-2026-82253High 8.7
gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
Affected: fixed in 0.83.0.
Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2026-82252High 8.7
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
Affected: fixed in 0.83.0.
Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2026-82251High 8.7
gitoxide before 0.52.1 Path Traversal via Submodule Name
Affected: fixed in 0.83.0.
Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2026-40034High 7.3
gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
Affected: from 0.31.0, fixed in 0.83.0.
Fixed in 0.83.0 (released Apr 27, 2026, 29 days before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2025-31130Medium 6.8
gitoxide does not detect SHA-1 collision attacks
Affected: fixed in 0.71.0.
Fixed in 0.71.0 (released Apr 4, 2025, the day of disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2024-35197Medium 5.4
gix refs and paths with reserved Windows device names access the devices
Affected: fixed in 0.63.0.
Fixed in 0.63.0 (released May 22, 2024, 1 day before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2024-35186High 8.8
gix traversal outside working tree enables arbitrary code execution
Affected: fixed in 0.63.0.
Fixed in 0.63.0 (released May 22, 2024, 1 day before disclosure).
The latest release, 0.90.0, is not affected.
- CVE-2024-32884Medium 6.4
gix-transport indirect code execution via malicious username
Affected: fixed in 0.62.
Fixed in 0.62.0 (released Apr 13, 2024, 13 days before disclosure).
The latest release, 0.90.0, is not affected.