gix-blame

An idiomatic, lean, fast & safe pure Rust implementation of Git

View on Cargo

View on Github

Activity

Latest release: 2w ago
Total releases: 20
Cadence: ~27 days
Last 12 months: 15

Reach

Downloads: 4.5M
Stars: 11.9k

Details

License: MIT OR Apache-2.0
First release: Jan 18, 2025

Releases

Version	Released
`0.17.1` patch	Aug 24, 2026
`0.17.0` minor	Aug 22, 2026
`0.16.0` unknown	Jul 23, 2026
`0.15.0` unknown	Jun 22, 2026
`0.14.0` unknown	May 26, 2026
`0.13.0` unknown	Apr 27, 2026
`0.12.0` unknown	Apr 24, 2026
`0.11.0` unknown	Mar 22, 2026
`0.10.0` unknown	Feb 22, 2026
`0.9.0` unknown	Feb 10, 2026
`0.8.0` unknown	Jan 22, 2026
`0.7.0` unknown	Dec 31, 2025
`0.6.0` unknown	Dec 22, 2025
`0.5.0` unknown	Nov 22, 2025
`0.4.0` unknown	Oct 22, 2025
`0.3.0` unknown	Jul 15, 2025
`0.2.1` unknown	Apr 26, 2025
`0.2.0` unknown yanked	Apr 25, 2025
`0.1.0` unknown	Apr 04, 2025
`0.0.0` unknown 1 CVE	Jan 18, 2025

Repository

gitoxidelabs/gitoxide

Forks: 544
Open issues: 1
Language: Rust

git
cli
blazingly-fast
built-with-rust
version-control

Dependencies (13)

Depends on

0.17.1

Used by

Supply-chain exposure

2 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2025-31130 GHSA-2frx-2596-x5r6 RUSTSEC-2025-0021 Apr 04, 2025

gitoxide does not detect SHA-1 collision attacks

6.8 / 10
Medium
Network High None None Changed None High None

Summary

gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks.

Details

gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide.

The SHA-1 function is considered cryptographically insecure. However, in the wake of the SHAttered attacks, this issue was mitigated in Git 2.13.0 in 2017 by using the sha1collisiondetection algorithm by default and producing an error when known SHA-1 collisions are detected. Git is in the process of migrating to using SHA-256 for object hashes, but this has not been rolled out widely yet and gitoxide does not support SHA-256 object hashes.

PoC

The following program demonstrates the problem, using the two SHAttered PDFs:

use sha1_checked::{CollisionResult, Digest}; fn sha1_oid_of_file(filename: &str) -> gix::ObjectId { let mut hasher = gix::features::hash::hasher(gix::hash::Kind::Sha1); hasher.update(&std::fs::read(filename).unwrap()); gix::ObjectId::Sha1(hasher.digest()) } fn sha1dc_oid_of_file(filename: &str) -> Result<gix::ObjectId, String> { // Matches Git’s behaviour. let mut hasher = sha1_checked::Builder::default().safe_hash(false).build(); hasher.update(&std::fs::read(filename).unwrap()); match hasher.try_finalize() { CollisionResult::Ok(digest) => Ok(gix::ObjectId::Sha1(digest.into())), CollisionResult::Mitigated(_) => unreachable!(), CollisionResult::Collision(digest) => Err(format!( "Collision attack: {}", gix::ObjectId::Sha1(digest.into()).to_hex() )), } } fn main() { dbg!(sha1_oid_of_file("shattered-1.pdf")); dbg!(sha1_oid_of_file("shattered-2.pdf")); dbg!(sha1dc_oid_of_file("shattered-1.pdf")); dbg!(sha1dc_oid_of_file("shattered-2.pdf")); }

The output is as follows:

[src/main.rs:24:5] sha1_oid_of_file("shattered-1.pdf") = Sha1(38762cf7f55934b34d179ae6a4c80cadccbb7f0a) [src/main.rs:25:5] sha1_oid_of_file("shattered-2.pdf") = Sha1(38762cf7f55934b34d179ae6a4c80cadccbb7f0a) [src/main.rs:26:5] sha1dc_oid_of_file("shattered-1.pdf") = Err( "Collision attack: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a", ) [src/main.rs:27:5] sha1dc_oid_of_file("shattered-2.pdf") = Err( "Collision attack: 38762cf7f55934b34d179ae6a4c80cadccbb7f0a", )

The latter behaviour matches Git.

Since the SHAttered PDFs are not in a valid format for Git objects, a direct proof‐of‐concept using higher‐level APIs cannot be immediately demonstrated without significant computational resources.

Impact

An attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in the logic of programs using gitoxide to cause further vulnerabilities.

This vulnerability affects any user of gitoxide, including gix-* library crates, that reads or writes Git objects.

Fixed in

0.1.0

References

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6
https://nvd.nist.gov/vuln/detail/CVE-2025-31130
https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21
https://github.com/GitoxideLabs/gitoxide
https://rustsec.org/advisories/RUSTSEC-2025-0021.html

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 1
patch 1
unknown 18

20 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More