# gix (crates.io) vulnerabilities 8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.90.0 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 0.90.0 (Oct 22, 2026), the latest release - Weekly downloads: 1M - Dependents: 0 - Releases: 75 since 0.0.0 (Feb 10, 2023) - Registry: https://crates.io/crates/gix - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-82253: 0.0.0 to 0.82.0 (0.83.0 is outside it) - CVE-2026-82252: 0.0.0 to 0.82.0 (0.83.0 is outside it) - CVE-2026-82251: 0.0.0 to 0.82.0 (0.83.0 is outside it) - CVE-2026-40034: 0.35.0 to 0.82.0 (0.83.0 is outside it) - CVE-2025-31130: 0.0.0 to 0.70.0 (0.71.0 is outside it) - CVE-2024-35197: 0.0.0 to 0.62.0 (0.63.0 is outside it) - CVE-2024-35186: 0.0.0 to 0.62.0 (0.63.0 is outside it) - CVE-2024-32884: 0.0.0 to 0.61.1 (0.62.0 is outside it) ## Advisories (8) ### [CVE-2026-82253](https://cve.now/CVE-2026-82253): gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 0.83.0. - Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2026-82252](https://cve.now/CVE-2026-82252): gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 0.83.0. - Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2026-82251](https://cve.now/CVE-2026-82251): gitoxide before 0.52.1 Path Traversal via Submodule Name - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 0.83.0. - Fixed in 0.83.0 (released Apr 27, 2026, 123 days before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2026-40034](https://cve.now/CVE-2026-40034): gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule - Severity: High 7.3 - Published: May 26, 2026 - Affected: from 0.31.0, fixed in 0.83.0. - Fixed in 0.83.0 (released Apr 27, 2026, 29 days before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2025-31130](https://cve.now/CVE-2025-31130): gitoxide does not detect SHA-1 collision attacks - Severity: Medium 6.8 - Published: Apr 4, 2025 - Affected: fixed in 0.71.0. - Fixed in 0.71.0 (released Apr 4, 2025, the day of disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2024-35197](https://cve.now/CVE-2024-35197): gix refs and paths with reserved Windows device names access the devices - Severity: Medium 5.4 - Published: May 23, 2024 - Affected: fixed in 0.63.0. - Fixed in 0.63.0 (released May 22, 2024, 1 day before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2024-35186](https://cve.now/CVE-2024-35186): gix traversal outside working tree enables arbitrary code execution - Severity: High 8.8 - Published: May 23, 2024 - Affected: fixed in 0.63.0. - Fixed in 0.63.0 (released May 22, 2024, 1 day before disclosure). - The latest release, 0.90.0, is not affected. ### [CVE-2024-32884](https://cve.now/CVE-2024-32884): gix-transport indirect code execution via malicious username - Severity: Medium 6.4 - Published: Apr 26, 2024 - Affected: fixed in 0.62. - Fixed in 0.62.0 (released Apr 13, 2024, 13 days before disclosure). - The latest release, 0.90.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/gix Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.