← Packages
rust-gix-0.73
Rust crate "gix"
- Current
- 0.73.0
- Candidate
- Stale
- Release line
- 0.73.x
- License
- MIT OR Apache-2.0
Advisory · 4
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodulesOSV
- Fixed events
- 0.83.0OSV
- EPSS model date
- 2026-11-12FIRST
- EPSS probability
- 0.651%FIRST
- Returned advisory
- GHSA-f26g-jm89-4g65OSV
- Aliases
- GHSA-f26g-jm89-4g65OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- Summary
- gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repositoryOSV
- Fixed events
- 0.83.0OSV
- EPSS model date
- 2026-11-12FIRST
- EPSS probability
- 0.522%FIRST
- Returned advisory
- GHSA-fr8x-3vfx-f45hOSV
- Aliases
- GHSA-fr8x-3vfx-f45hOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:POSV
- References
- Web · github.com
- Summary
- gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repositoryOSV
- Fixed events
- 0.83.0OSV
- EPSS model date
- 2026-11-12FIRST
- EPSS probability
- 0.522%FIRST
- Returned advisory
- GHSA-pg4w-g64p-qwhjOSV
- Aliases
- GHSA-pg4w-g64p-qwhjOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:POSV
- References
- Web · github.com
- Summary
- gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosureOSV
- Fixed events
- 0.83.0OSV
- EPSS model date
- 2026-11-12FIRST
- EPSS probability
- 0.657%FIRST
- Returned advisory
- GHSA-p3hw-mv63-rf9wOSV
- Aliases
- GHSA-p3hw-mv63-rf9wOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- References
- Web · github.com
Description
Source code for takopackized Rust crate "gix"
Changelog
PR · 3
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-13T15:09:50+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Not applicable No confirmed version upgrade; this monitor is not run. | — | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |