gitoxide EUVD-2026-31831

Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an

Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during c

Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious

Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repositor

Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal

Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass

Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to

Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena

Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker