{"action":"Upgrade gix to 0.90.0 or later.","affected":[{"fixed":"0.90.0","introduced":"0.88.0"}],"component":"gix","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.90.0"],"ghsa_id":"GHSA-q54r-jf2p-rfr2","id":"tcs_01M5NATA2YWXJDZ4ZWKT5XQY2F","modified_at":"2026-10-23T21:00:06.833400057Z","published_at":"2026-10-23T20:52:28Z","references":["https://osv.dev/vulnerability/GHSA-q54r-jf2p-rfr2","https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-q54r-jf2p-rfr2","https://github.com/GitoxideLabs/gitoxide/pull/3068","https://github.com/GitoxideLabs/gitoxide/commit/743957880154aa1726b30b8b5779fd10c78a058c","https://github.com/GitoxideLabs/gitoxide","https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-v0.90.0"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-q54r-jf2p-rfr2","url":"https://osv.dev/vulnerability/GHSA-q54r-jf2p-rfr2"}],"summary":"gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()"}