jj-lib
A Git-compatible VCS that is both simple and powerful
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 41
- Cadence
- ~28 days
- Last 12 months
- 12
Reach
- Downloads
- 250.4k
- Stars
- 31.5k
Details
- License
- Apache-2.0
- First release
- Jul 16, 2023
| Version | Released | |
|---|---|---|
0.45.1
minor
|
0.45.1
minor
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.44.0
minor
|
0.44.0
minor
Dependencies (55)
+ 47 more
Changelog
Compare changes
|
|
0.43.0
unknown
|
0.43.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.42.0
unknown
|
0.42.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.41.0
unknown
|
0.41.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.40.0
unknown
|
0.40.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.39.0
unknown
|
0.39.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.38.0
unknown
|
0.38.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.37.0
unknown
|
0.37.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.36.0
unknown
|
0.36.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.35.0
unknown
|
0.35.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.34.0
unknown
|
0.34.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.33.0
unknown
|
0.33.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.32.0
unknown
|
0.32.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.31.0
unknown
|
0.31.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.30.0
unknown
|
0.30.0
unknown
Dependencies (52)
+ 44 more
Changelog
Compare changes
|
|
0.29.0
unknown
|
0.29.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.28.2
unknown
|
0.28.2
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.28.1
unknown
|
0.28.1
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.28.0
unknown
yanked
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.28.0
unknown
yanked
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.27.0
unknown
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.27.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.26.0
unknown
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.26.0
unknown
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
0.25.0
unknown
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.25.0
unknown
Dependencies (55)
+ 47 more
Changelog
Compare changes
|
|
0.24.0
unknown
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.24.0
unknown
Dependencies (55)
+ 47 more
Changelog
Compare changes
|
|
0.23.0
unknown
1 CVE
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev |
0.23.0
unknown
Dependencies (56)
+ 48 more
Changelog
Compare changes
|
|
0.22.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.22.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.21.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.21.0
unknown
Dependencies (54)
+ 46 more
Changelog
Compare changes
|
|
0.20.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.20.0
unknown
Dependencies (52)
+ 44 more
Changelog
Compare changes
|
|
0.19.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.19.0
unknown
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.18.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.18.0
unknown
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.17.1
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.17.1
unknown
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.17.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.17.0
unknown
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.16.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.16.0
unknown
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
0.15.1
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.15.1
unknown
Dependencies (49)
+ 41 more
Changelog
Compare changes
|
|
0.14.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.14.0
unknown
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
0.13.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.13.0
unknown
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
0.12.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.12.0
unknown
Dependencies (47)
+ 39 more
Changelog
Compare changes
|
|
0.11.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.11.0
unknown
Dependencies (44)
+ 36 more
Changelog
Compare changes
|
|
0.10.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.10.0
unknown
Dependencies (40)
+ 32 more
Changelog
Compare changes
|
|
0.9.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.9.0
unknown
Dependencies (40)
+ 32 more
Changelog
Compare changes
|
|
0.8.0
unknown
2 CVEs
GHSA-794x-2rpg-rfgr
Apr 07, 2025
Jujutsu does not have SHA-1 collision detection
6.8
/ 10
Medium
Network
High
None
None
Changed
None
High
None
SummaryJujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. DetailsThis is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu. ImpactAn attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities. Fixed in
0.28.1
References Updated Apr 07, 2025 · Source: OSV.dev
CVE-2024-51990
GHSA-88h5-6w7m-5w56
Nov 07, 2024
jj vulnerable to path traversal via crafted Git repositories
Critical
Network
Low
None
None
ImpactSpecially crafted Git repositories can cause PatchesFixed in 0.23.0. WorkaroundsNot much other than to not clone repositories from untrusted sources. ReferencesHere's the original report from @joernchen:
Fixed in
0.23.0
References Updated Nov 07, 2024 · Source: OSV.dev |
0.8.0
unknown
Dependencies (35)
+ 27 more
Changelog
|