Repository navigation
Conversation
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gix`, preserving the original GitHub Advisory Database attribution. Source: GHSA-98p4-xjmm-8mfh An SSH URL username can inject options and load an attacker-controlled configuration. Review corrections: - Normalize wrapper patched versions>=0.62 and>=0.35 to complete versions>=0.62.0 and>=0.35.0. - Retain the extra malicious-current-directory configuration prerequisite for code execution; a crafted URL alone does not demonstrate it. - Reference the actual username fix f56ad390, rather than treating older host/path PR1032 as this vulnerability's remediation. - Exclude the published empty, dependency-free gix 0.0.0 placeholder; 0.35.0 is the first functional gix release. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Contributor
Author
|
The PR is still in draft to see if this format is correct. |
Member
Are you planning to patch this? |
djc
reviewed
Nov 13, 2026
| aliases = ["GHSA-2frx-2596-x5r6", "CVE-2025-31130"] | ||
| url = "https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21" | ||
| license = "CC-BY-4.0" | ||
| references = ["https://github.com/advisories/GHSA-2frx-2596-x5r6", "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6", "https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21", "https://github.com/GitoxideLabs/gitoxide/releases/tag/v0.42.0"] |
Member
There was a problem hiding this comment.
Don't repeat references that are already in the metadata in other places (this seems to have two different links to a GHSA already mentioned in aliases, as well as the commit link in url).
Contributor
Author
There was a problem hiding this comment.
Codex on behalf of Byron: Fixed in 09cb8b5 (fixup! Import GHSA-2frx-2596-x5r6 for RustSec) and matching fixups for the other imports. References now omit URLs already represented by aliases or url; distinct supporting links remain. The full CI-pinned rustsec-admin lint passes. Byron will review these changes later; this thread remains open.
|
|
||
| Reported by [emilazy](https://github.com/emilazy), with analysis by [EliahKagan](https://github.com/EliahKagan). | ||
|
|
||
| Adapted from [GHSA-2frx-2596-x5r6](https://github.com/advisories/GHSA-2frx-2596-x5r6) under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/); descriptions and affected ranges were reviewed and corrected. |
Contributor
Author
There was a problem hiding this comment.
Codex on behalf of Byron: Removed the repeated adaptation footer in 09cb8b5 and corresponding fixups across all 66 entries. The GHSA aliases, CC-BY-4.0 metadata, and reporter credits remain. The full CI-pinned rustsec-admin lint passes. Byron will review these changes later; this thread remains open.
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin lint passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gitoxide-core`, `gix`, `gix-worktree-state`, preserving the original GitHub Advisory Database attribution. Source: GHSA-49jc-r788-3fc9 Reserved Windows device names can redirect checkout writes. Review corrections: - Condense repetitive PoCs and retain confirmed Windows console/ref/checkout effects without asserting serial-device exploitation or direct arbitrary code execution. - Tailor gix-worktree-state prose to checkout writes; reference-reading behavior belongs to gix-ref and consuming wrappers. - Preserve the Windows restriction and correct package-specific safe version 0.11.0. - Preserve the Windows restriction and correct package-specific safe version 0.36.0. - Preserve the Windows restriction and correct package-specific safe version 0.38.0. - Preserve the Windows restriction and correct package-specific safe version 0.63.0. - Exclude the published empty, dependency-free gix 0.0.0 placeholder; 0.35.0 is the first functional gix release. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gitoxide-core`, `gix`, `gix-worktree-state`, preserving the original GitHub Advisory Database attribution. Source: GHSA-7w47-3wg8-547c Checkout paths can escape the worktree and install hooks. Review corrections: - Explain that clone creates attacker-controlled files and hook execution occurs during a later Git operation; do not imply cloning necessarily executes payloads immediately. - Preserve all-platform traversal exposure and Windows/NTFS/HFS-specific aliases without applying an exclusive OS restriction. - Retain per-package fixed release 0.11.0 rather than assuming workspace crates share versions. - Retain per-package fixed release 0.36.0 rather than assuming workspace crates share versions. - Retain per-package fixed release 0.63.0 rather than assuming workspace crates share versions. - Exclude the published empty, dependency-free gix 0.0.0 placeholder; 0.35.0 is the first functional gix release. - Retain per-package fixed release 0.38.0 rather than assuming workspace crates share versions. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, preserving the original GitHub Advisory Database attribution. Source: GHSA-88g2-r9rw-g55h Terminal control characters in repository metadata can spoof command output. Review corrections: - Do not infer a patched version from stale source upper bound0.41.0; current released0.61.0 remains exposed in the original tree-entry output path, so patched=[]. - Distinguish partial July2026 index-entry remediation from complete terminal-output remediation. - Avoid obsolete broad Windows terminal assumptions and retain terminal-dependent spoofing/social-engineering impact without claiming automatic command execution. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gitoxide-core`, `gix`, `gix-archive`, `gix-blame`, `gix-commitgraph`, `gix-config`, `gix-diff`, `gix-dir`, `gix-discover`, `gix-filter`, `gix-fsck`, `gix-index`, `gix-merge`, `gix-negotiate`, `gix-object`, `gix-odb`, `gix-pack`, `gix-protocol`, `gix-ref`, `gix-revision`, `gix-revwalk`, `gix-status`, `gix-traverse`, `gix-worktree`, `gix-worktree-state`, preserving the original GitHub Advisory Database attribution. Source: GHSA-2frx-2596-x5r6 gix-commitgraph uses Git hashing without SHA-1 collision detection. Review corrections: - Qualify exposure through SHA-1 object workflows and the affected dependency graph; unrelated uses are not demonstrations of an attack. - Remove obsolete blanket SHA-256-support claim and attack-cost projections; distinguish the PDF hash demonstration from valid Git-object exploitation. - Use 2025-04-03, the canonical first-disclosure date already recorded for this CVE in RUSTSEC-2025-0021, rather than the later GHSA publication date. - Exclude the empty, dependency-free 0.0.0 placeholder; first functional published release is 0.35.0. - Exclude the empty, dependency-free 0.0.0 placeholder; first functional published release is 0.1.0. - Keep 0.0.0 affected: its published source implements blame and depends on vulnerable gix-object 0.47. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-transport`, preserving the original GitHub Advisory Database attribution. Source: GHSA-9857-6mw7-fq2m HTTP redirects can forward credentials to a different authority. Review corrections: - Included gix-transport 0.55.1, published before the redirect fix but omitted by the source affected upper bound 0.55.0. - Qualified the blanket assertion that reqwest is unaffected: its old host-only policy blocks the demonstrated cross-host case but does not enforce full authority/scheme checks. - Retained the supported source CVSS vector; computed score agrees. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix`, `gix-submodule`, preserving the original GitHub Advisory Database attribution. Source: GHSA-f26g-jm89-4g65 A partial local override can allow an untrusted submodule update command. Review corrections: - Corrected gix introduction from the source range >0.31.0 to >=0.52.0: the public Submodule::update API was introduced after 0.51.0 and first published in 0.52.0. - Added the affected public plumbing package gix-submodule, first published at 0.1.0 and fixed at 0.29.0. - Clarified that command execution is performed by downstream consumers, not by the accessor or the then-current gitoxide CLI. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gix`, preserving the original GitHub Advisory Database attribution. Source: GHSA-fr8x-3vfx-f45h Unvalidated submodule names can redirect repository resolution outside `.git/modules`. Review corrections: - Corrected the second source package row from `gitoxide` to `gix`: its 0.81/0.82 range refers to the library package, while the CLI range is 0.52.0/0.52.1. - Marked gix versions before 0.52.0 unaffected because the relevant Submodule APIs were first published in 0.52.0. - Preserved repository-confusion impact without inferring command execution or attacker exfiltration. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix`, `gix-validate`, preserving the original GitHub Advisory Database attribution. Source: GHSA-p3hw-mv63-rf9w Submodule traversal validation and inherited trust can expose the wrong repository. Review corrections: - Extended affected gix bounds through 0.81.0 and gix-validate bounds through 0.11.0: both published releases still contain the vulnerability. - Marked gix <0.52.0 and gix-validate <0.8.0 unaffected based on the first published relevant APIs. - Limited the credential claim to configuration access with conditional downstream disclosure; the source does not establish an attacker exfiltration sink. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gix`, preserving the original GitHub Advisory Database attribution. Source: GHSA-pg4w-g64p-qwhj A symlinked `.gitmodules` can supply configuration from outside the worktree. Review corrections: - Marked gix versions before 0.52.0 unaffected based on introduction and first publication of the submodule-loading API. - Retained configuration-injection impact and its prerequisites without inferring command execution. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-pack`, preserving the original GitHub Advisory Database attribution. Source: GHSA-x494-mj8g-cj27 Malformed pack data can panic or cause excessive allocations. Review corrections: - Corrected the complete patched boundary from 0.69.0 to 0.73.0: the source-listed streaming and delta-tree allocation sinks remain in 0.69.0 and are fixed by follow-up rustsec#2690. - Replaced guaranteed OOM-kill/process-abort wording with allocator-, operating-system-, and caller-dependent effects. - Removed the unsupported statement that no gix-pack fuzz targets exist; the fixing series includes existing fuzz targets. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-fs`, preserving the original GitHub Advisory Database attribution. Source: GHSA-f89h-2fjh-2r9q Cached symlink prefixes can redirect checkout writes outside the worktree. Review corrections: - Condensed the advisory while retaining the demonstrated symlink-write primitive and conditional later code execution. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-packetline`, preserving the original GitHub Advisory Database attribution. Source: GHSA-2vh6-hw4j-32ww Empty side-band packets can panic during fetch. Review corrections: - Replace universal "process abort"/"any application crashes" claim with operation interruption and termination when panic is unhandled. - Retain empty progress/error packet trigger and distinguish empty data with no band designator. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-credentials`, preserving the original GitHub Advisory Database attribution. Source: GHSA-6wr8-3w4h-j9wj Carriage returns can inject fields into credential-helper requests. Review corrections: - Keep limited helper/application prerequisites and distinguish returning another host credentials from demonstrated direct remote exfiltration. - Describe actual released fix instead of suggested diff. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix`, `gix-worktree`, `gix-worktree-state`, preserving the original GitHub Advisory Database attribution. Source: GHSA-pmm9-4h7q-24c8 Incremental checkout can write through a symlink on Windows. Review corrections: - Preserve confirmed Windows/incremental/existing-symlink preconditions; do not claim privilege escalation, arbitrary CLI reachability, or untested collision variants. - Explain the opt-in stack API and automatic enablement by incremental checkout. - Exclude the published empty, dependency-free gix 0.0.0 placeholder; 0.35.0 is the first functional gix release. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-url` and `gix-transport`, retaining the original GitHub Advisory Database attribution. Source: GHSA-jrcm-326h-gpp8 Query and fragment delimiters cause the custom URL parser to disagree with the HTTP client about a redirect's authority. The credential-reuse guard can retain an origin's HTTP Basic credentials with the curl backend and attach them to a subsequent POST to a different authority. Use the verified `gix-url` affected range `>=0.33.2,<0.37.1` and the `gix-transport` guard-bypass range `>=0.56.0,<0.58.1`. The current GHSA metadata mistakes the introduction versions for patched releases. Earlier unguarded credential forwarding is a distinct issue covered by GHSA-9857-6mw7-fq2m. Preserve feature prerequisites and compatible dependency-update mitigation. Validate safe ranges against published versions with Cargo semver and run RustSec CI's pinned `rustsec-admin lint`. Existing advisory files are preserved. No source CVSS vector is supplied, so omit the optional field. Use the parser-fix commit as the transport entry's primary URL to satisfy current RustSec lint; retain both original GHSA URLs in references and explicit linked `CC-BY-4.0` attribution in the body. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-transport`, preserving the original GitHub Advisory Database attribution. Source: GHSA-rc7h-wp5f-w3g5 Control bytes in git-daemon requests can inject protocol parameters. Review corrections: - Correct ecosystem='other' to published Cargo gix-transport. - Narrow CR/LF/NUL claims to NUL/LF injection: actual serializer/regressions reject those bytes, not CR. - Replace stale no-fix prose with published0.59.2. - Omit optional CVSS because C:L/I:L effects depend on unspecified daemon/access policy, beyond demonstrated injection. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-sec`, preserving the original GitHub Advisory Database attribution. Source: GHSA-7rhf-42qf-vrvc Elevated Windows administrators can incorrectly trust other users’ repositories. Review corrections: - Condensed prerequisites and retained the locally configured command-execution impact. - Used the source first-public publication timestamp rather than private advisory creation date; no evidence of earlier public disclosure is present in the retained snapshot. - Restored linked reporter attribution from the source GitHub advisory API credits. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-pack`, preserving the original GitHub Advisory Database attribution. Source: GHSA-633h-mqjc-8rwg A version 3 pack header can cause a panic during streaming pack input. Review corrections: - Correct ecosystem='other' to published Cargo gix-pack. - Correct reversed patched_versions<=0.75.0 to safe>=0.75.0; source safe range includes vulnerable versions. - Actual fix accepts supported V3, rather than suggested rejection; related writers fixed too. - Qualify universal preauthentication/process-death/every-clone claims by supplied-pack trigger and panic handling. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-fs`, preserving the original GitHub Advisory Database attribution. Source: GHSA-6p9q-f2xg-6pr5 Forced checkout can reuse a stale symlink prefix and modify paths outside the worktree. Review corrections: - Describe exact symlink creation/replacement/deletion primitive and forced Unix single-stack prerequisites. - Preserve distinct relation to GHSA-f89h; avoid claiming normal clone or arbitrary regular-file writes were reproduced. - Add0.23.0 remediation; actual fix revalidates terminal entries rather than merely changing pop-loop assignment. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-pack`, preserving the original GitHub Advisory Database attribution. Source: GHSA-mpf5-465h-mr53 Invalid thin-pack delta offsets can panic during fetch. Review corrections: - Correct source ecosystem "other" to Cargo: gix-pack is a published Rust crate. - Replace stale "no post-tag fix" prose with the released fix; distinguish fetch interruption/unhandled panic from unconditional process abort. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-mailmap`, preserving the original GitHub Advisory Database attribution. Source: GHSA-pmpw-wwcm-r8rc Quadratic mailmap construction can cause excessive CPU consumption. Review corrections: - Remove erroneous claim that Git's C mailmap loader sorts once; fix commit documents Git also uses sorted insertion. - Include email and per-name construction and shared new()/merge() callers. - Add published0.35.0 remediation and avoid machine-specific timing promises. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-pack`, preserving the original GitHub Advisory Database attribution. Source: GHSA-x862-c2wj-4mwr Pack object counts can trigger infallible allocation failure. Review corrections: - Correct source ecosystem "other" to Cargo. - Remove fixed hundreds-of-gigabytes figures, assertions about Linux overcommit rejection, and universal pre-authentication/process-abort claims; actual rejection is allocator/platform dependent. - Replace stale suggested-fix/no-fix prose with released fallible-allocation correction. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gitoxide`, `gix-commitgraph`, preserving the original GitHub Advisory Database attribution. Source: GHSA-989c-xj77-266r Malformed commit-graph files can cause panics during history traversal. Review corrections: - Remove unsupported statements that all ordinary clones carry attacker-supplied commit-graph files and every embedding application loses its whole process. - Replace stale no-fix prose with published0.42.0/0.61.0 remediation. - Keep both malformed-field triggers; omit unrelated checksum amplification claims. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix`, preserving the original GitHub Advisory Database attribution. Source: GHSA-q54r-jf2p-rfr2 Reduced-trust configuration can disable filesystem path protections. Review corrections: - Correct introduced version from0.88.0 to0.63.0; protect_options() was introduced May2024, shipped in aggregate v0.36.0. - Replace stale unfixed prose with published0.90.0 remediation, including early reference-store read. - Distinguish demonstrated trust-filter bypass from conditional filesystem-alias metadata/hook consequences. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Make this public Gitoxide vulnerability discoverable to downstream Rust users through tools such as `cargo audit`. Add package-specific entries for `gix-fs`, preserving the original GitHub Advisory Database attribution. Source: GHSA-xw69-xv93-5fjv Windows symlink target probes can disclose NTLM authentication material. Review corrections: - Replace stale no-fixed-release prose with published0.24.1 remediation. - Preserve direct and indirect targets, qualifying SMB/NTLM exposure by Windows symlink and network prerequisites. Validate the reviewed safe ranges against published versions with Cargo semver, and run RustSec CI's pinned `rustsec-admin lint` before committing. Existing advisories are preserved. Use a relevant report/fix as the primary URL to satisfy current RustSec lint; retain original GHSA attribution in references and the CC-BY-4.0 body credit. Assisted-by: Codex <codex@openai.com> Co-authored-by: Codex <codex@openai.com>
Address djc's review comments on PR rustsec#3561: "Don't repeat references that are already in the metadata in other places" and "This doesn't seem useful" on the closing import boilerplate. Remove references duplicating aliases or the primary URL and omit empty reference fields. Remove the repeated adaptation footer; keep source GHSA aliases, CC-BY-4.0 metadata, reporter credits, and distinct useful links. Validation: unchanged vulnerability metadata and substantive prose checked against the original import; git diff --check and the CI-pinned rustsec-admin syntax checks passed. Byron will review these changes later.
Contributor
Author
|
Codex on behalf of Byron, replying to djc's GHSA-88g2 question: |
EliahKagan
suggested changes
Nov 13, 2026
Contributor
There was a problem hiding this comment.
@Byron Thanks for working on this!
As you have probably guessed from our recent conversation, I don't have time right now to examine this in detail and post a comprehensive review, and since it may be a long while before I do, I don't advocate waiting for that. Accordingly, I worry a bit that this review might be seen as "backseat driving." (I also recognize that this remains a draft, and that by the time it is marked ready to review, it may be different and the Codex skill used to help with it may be rewritten.)
However, I did notice a couple of things I found concerning and that I think may be blocking. As this currently stands, it adds lots of entries it shouldn't add at all regardless of what exists in GHSA, and it does so in a way that violates the principle of least surprise in a profound way.
Same-database same-vulnerability entries with totally different descriptions
This PR creates additional entries for several vulnerabilities that already had RustSec advisories, and within the new material it retitles and rewrites the descriptions of those vulnerabilities. Rewriting advisories that are in bad shape is a good thing to do. (Indeed, I advocated this when we discussed the matter recently, and I also advocated automating or assisting this process to a substantial extent using a Codex skill--so if this has not yet altogether worked out well, then I am partly to blame.) But I don't think that applies to any advisories that were already in the RustSec database for gitoxide.
If the text of an advisory is unsuitable to be imported into the RustSec database, then we should usually be revising it in the GHSA too. However, I acknowledge that there might occasionally be exceptions to that, and that the GHSA revision does not always need to precede bringing the better text into RustSec.
(In addition, I would favor a higher level of detail than some of these rewritten versions, if it can be produced in a way that is high quality. In recent times, we get a lot of vulnerability reports produced with the help of LLMs that are often meandering and verbose in a way that's not useful. I myself tend to write long, which is reflected in some of our older advisories, but what I'm talking about tends to go way beyond that. It's hard to turn this into something high quality of intermediate length, but in cases where there is an already-existing useful analysis or reasonably-sized PoC, I think it can make sense to preserve that.)
If this PR were merged in this or a similar form, then the inconsistencies across different descriptions within RustSec itself of the same exact vulnerabilities would be very confusing. They would also make it challenging to figure out, given two RustSec advisories on gitoxide, whether they are intended to describe the same vulnerability. That they reference the same GHSAs and CVEs somewhat mitigates this! But it would not solve it for readers who aren't already familiar with the vulnerabilities involved, because sometimes vulnerabilities are broken down differently in different advisory databases.
Deviation from usual RustSec practices on when to duplicate advisories
As you allude to in #3561 (comment), this PR introduces a large increase in duplication of advisories for the same vulnerability across multiple crates. This overlaps with the consistency confusion I described above. In my mind, these concerns are mostly separate, but they do seem to have the same cause: adding entries that shouldn't be added at all. In addition, the consistency confusion obscures the duplication and may make it harder to detect and avoid merging it.
As I understand it, the standing practice in the RustSec advisory database has long been to avoid having advisories on crates that are vulnerable solely because they consume a crate that contains the vulnerability, even for crates that are part of the same project.
My opinion on that, which I hold weakly, is that the only non-harmful way to navigate this difference in structure and capabilities between the databases is to decide separately which crates need to be listed in GHSA and RustSec advisories:
- This minimalism is the least bad way to do things in the RustSec advisory database currently, because individual RustSec advisories cannot list multiple crates.
- But it has significant disadvantages if done in GHSA advisories that I think cause some users not to get Dependabot or Renovate alerts--or to get only alerts that, on examination, make no sense to them or even wrongly appear safe to dismiss--especially users who do not commit lockfiles.
- GHSA advisories very intentionally allow listing multiple affected packages. Users may expect to receive alerts for affected crates belonging to the same project that receive patched versions, even if those users are fully cognizant that a crate's dependents do not usually issue advisories for vulnerabilities in dependencies.
I wanted to mention this, since my reading of #3561 (comment) is that you were thinking of moving to a minimalist approach to affected-package metadata in GHSA advisories. See the discussion of this in the comments on GHSA-2frx-2596-x5r6, which are mirrored at GitoxideLabs/gitoxide#1915 (comment).
I've had Claude examine this and put together some more detailed information, which can be clicked to expand below, and which is also available in this gist. No part of the above text is generated by an LLM. In contrast, the following is entirely LLM-generated, though I iterated with the model on it for a while and also checked its claims.
Details on new entries for vulnerabilities RustSec already covers (LLM-generated)
#3561: new entries for vulnerabilities RustSec already covers
PR head reviewed: f2e3455610d6c1eaf65c0aa1f839c9a404010083 (2026-11-13).
1. Five vulnerabilities already have RustSec advisories, and the PR adds 37 more entries for them
| Vulnerability | Existing advisory | New entries | Example new entry |
|---|---|---|---|
| GHSA-2frx-2596-x5r6 | gix-features: RUSTSEC-2025-0021 (site) |
26 | gix |
| GHSA-7w47-3wg8-547c | gix-index: RUSTSEC-2024-0348 (site)gix-worktree: RUSTSEC-2024-0349 (site)gix-fs: RUSTSEC-2024-0350 (site) |
4 | gix-worktree-state |
| GHSA-49jc-r788-3fc9 | gix-ref: RUSTSEC-2024-0351 (site)gix-index: RUSTSEC-2024-0352 (site)gix-worktree: RUSTSEC-2024-0353 (site) |
4 | gix-worktree-state |
| GHSA-98p4-xjmm-8mfh | gix-transport: RUSTSEC-2024-0335 (site) |
2 | gix |
| GHSA-88g2-r9rw-g55h | gitoxide-core: RUSTSEC-2024-0364 (site) |
1 | gitoxide |
To check: the existing advisory and the example share the same aliases (GHSA and CVE).
2. The new entries describe those vulnerabilities in different words
The existing advisories use the GHSA text, adapted only for rustsec.org's Markdown; RUSTSEC-2024-0335 (site) also adds a paragraph on fixed versions. The new entries use a new, shorter rewrite of the GHSA, without the PoC. Entries for the same vulnerability share one text, with only the crate name and version changed. The exception is gix-worktree-state's GHSA-49jc-r788-3fc9 entry, whose title and first paragraph describe only checkout; its last paragraph still mentions refs.
| Vulnerability | Existing title | New title |
|---|---|---|
| GHSA-2frx-2596-x5r6 | SHA-1 collision attacks are not detected | <crate> uses Git hashing without SHA-1 collision detection |
| GHSA-7w47-3wg8-547c | Traversal outside working tree enables arbitrary code execution | Checkout paths can escape the worktree and install hooks |
| GHSA-49jc-r788-3fc9 | Refs and paths with reserved Windows device names access the devices | Reserved Windows device names can block cloning or spoof console output (gitoxide, gitoxide-core, gix)Reserved Windows device names can redirect checkout writes ( gix-worktree-state) |
| GHSA-98p4-xjmm-8mfh | gix-transport indirect code execution via malicious username | An SSH URL username can inject options and load an attacker-controlled configuration |
| GHSA-88g2-r9rw-g55h | gitoxide-core does not neutralize special characters for terminals | Terminal control characters in repository metadata can spoof command output |
To check: in any row of section 1, follow the link in the "Existing advisory" column and the link in the "Example new entry" column, and compare the two bodies.
3. The new crates already get flagged through the existing advisories
Claude checked every affected version of all 37 entries; the table shows one example per vulnerability. In each example's last affected version, the crate depends on the existing advisory's crate, at a version inside that advisory's affected range.
| Example | Dependencies of last affected version | Look for | Existing advisory's affected range |
|---|---|---|---|
gix (GHSA-2frx-2596-x5r6) |
gix 0.70.0 | gix-features ^0.40.0 |
< 0.41.0 |
gix-worktree-state (GHSA-7w47-3wg8-547c, GHSA-49jc-r788-3fc9) |
gix-worktree-state 0.10.0 | gix-fs ^0.10.2gix-index ^0.32.0gix-worktree ^0.33.0 |
< 0.11.0 < 0.33.0 < 0.34.0 |
gix (GHSA-98p4-xjmm-8mfh) |
gix 0.61.1 | gix-transport ^0.41.3 (optional) |
< 0.42.0 |
gitoxide (GHSA-88g2-r9rw-g55h) |
gitoxide 0.61.0 | gitoxide-core ^0.64.0 |
all versions |
Exception: old versions built on the pre-rename git-* crates (for example gix 0.35.0) fall outside the existing advisories.
4. RustSec doesn't file entries for crates affected only through a dependency
- djc, May 2026, the same maintainer reviewing this PR: rustsec/advisory-db#2900 review comment.
- Shnatsel, June 2023: rustsec/advisory-db#1705 comment. The earlier gitoxide imports cited and followed it, in rustsec/advisory-db#1996 and rustsec/advisory-db#2268.
5. Where the extra entries come from
The skill's coverage rule, SKILL.md line 28: "An alias already present for one crate does not cover another affected crate." The PR description mentions only that "The 13 package/vulnerability pairs already covered by RustSec are preserved."
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains all previously unported Gitoxide GitHub advisories and is the baseline for future monthly imports which I plan to make a day after any release, and after that month's GitHub advisories were published.
The assumption is that
cargo auditdoesn't pick up GitHub advisories automatically, so it makes sense to inform downstream by porting them here.Previously, we would rely on @EliahKagan to do so, but now we can actually do a better job at helping the process along.
About the process
I tasked Sol 6.1 in "Ultra" mode to review the published advisories and turn them into Rustsec advisories. It made a couple of corrections, see the details below, and
blocked on 2 advisories that I resolved by hand. "Ultra" mode also means it spawns its own subagents, including reviewers, which further decreases the chances of mistakes.
It took a while, and knowing 'it' tells me that it did a better job than I ever could, particularly in that time.
I also gave the commits only a cursory look, nothing stood out as obviously wrong, and created this PR by hand.
Tasks
Details by Codex
Gitoxide users rely on tools such as
cargo auditto identify vulnerable dependencies, but many published Gitoxide security advisories are missing from RustSec. This adds 66 package-specific entries across 35 Cargo crates and 26 published GHSAs, with one commit per GHSA. The 13 package/vulnerability pairs already covered by RustSec are preserved. New entries use draftRUSTSEC-0000-0000IDs for maintainer assignment.The entries were checked against the full source advisories, fixing code and tests, release manifests, and crates.io publication history. Substantive corrections include:
gitoxiderow that actually describesgix, and adding the independently affectedgix-submodulepackage.gix-packfix at 0.73.0 for GHSA-x494, rather than the incomplete 0.69.0 boundary, and correcting GHSA-633h's reversed patched range.gix-url >=0.33.2,<0.37.1andgix-transport >=0.56.0,<0.58.1. The transport entry describes the demonstrated curl redirect-guard bypass. Its lower unaffected range applies only to that issue; earlier unguarded credential forwarding is covered separately by GHSA-9857.gitoxide, since the index-output fix does not fix raw tree-entry output.All entries retain source advisory links and reporter attribution under
CC-BY-4.0. Primary URLs point to relevant reports or fixes to satisfy the current RustSec linter; the original GHSAs remain in references and explicit linked attribution.