Vendor

    Gitoxidelabs

    21 known vulnerabilities in products by Gitoxidelabs, 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Gitoxidelabs
    HighCVE-2026-82253

    gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

    		7.5
    HighCVE-2026-82252

    gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules

    		7.5
    HighCVE-2026-82251

    gitoxide before 0.52.1 Path Traversal via Submodule Name

    		7.5
    HighCVE-2026-82254

    gitoxide before 0.69.0 Denial of Service via gix-pack

    		7.5
    HighCVE-2026-82247

    gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

    		7.5
    HighCVE-2026-82250

    gitoxide gix-packetline before 0.21.5 Denial of Service

    		6.5
    HighCVE-2026-82255

    gitoxide 0.25.4 HTTP Credential Leak via Redirect

    		6.8
    HighCVE-2026-109351

    Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

    		6.5
    HighCVE-2026-109350

    Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

    		6.5
    HighCVE-2026-109349

    gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

    		6.5
    HighCVE-2026-100419

    gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink

    		7.0
    MediumCVE-2025-24890

    gix-sec safe.directory protections absent for elevated administrators

    		6.8
    MediumCVE-2026-82248

    gitoxide before 0.33.0 Path Traversal via symlink following

    		5.3
    MediumCVE-2026-109348

    Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

    		4.3
    HighCVE-2026-44471

    gitoxide: Symlink prefix-reuse allows worktree escape during checkout

    		7.8
    MediumCVE-2026-91986

    gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

    		5.4
    HighCVE-2026-0810

    Gix-date: gix-date: undefined behavior due to invalid string generation

    also in 4 other products

    		7.1
    MediumCVE-2025-31130

    gitoxide does not detect SHA-1 collision attacks

    		6.8
    LowCVE-2026-82249

    gitoxide before 0.38.2 Credential Helper Protocol Field Injection

    		3.1
    MediumCVE-2025-22620

    gix-worktree-state nonexclusive checkout sets executable files world-writable

    		5.0
    MediumCVE-2023-53158

    GitoxideLabs Gix-transport: OS Command Injection

    		4.1

    Products

    Products by Gitoxidelabs
    Gitoxide160
    Gix-pack30