Sign in Sign up

github.com/michaelmure/git-bug

Activity

Latest release: 1y ago
Total releases: 6
Cadence: ~6 days
Last 12 months: 0

Reach

Stars: —

Details

First release: Mar 21, 2021

Releases

Version	Released
`v0.10.1` patch	May 19, 2025
`v0.10.0` minor	May 18, 2025
`v0.9.0` minor	May 12, 2025
`v0.8.1` patch	May 05, 2025
`v0.8.0` minor	Nov 20, 2022
`v0.7.2` initial	Mar 21, 2021

Repository

michaelmure/git-bug

Forks: —
Open issues: —

Dependencies (34)

Depends on

v0.10.1

Supply-chain exposure

Vulnerable dependencies

2 of 34

github.com/blevesearch/bleve 1 CVE
golang.org/x/crypto 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

CVE-2021-28955 GHSA-m898-h4pm-pqfr May 25, 2021

Arbitrary code execution due to an uncontrolled search path for the git binary

9.8 / 10
Critical
Network Low None None Unchanged High High High

Impact

The go language recently addressed a security issue in the way that binaries are found before being executed. Some operating systems like Windows persist to have the current directory being part of the default search path, and having priority over the system-wide path.

This means that it's possible for a malicious user to craft for example a git.bat command, commit it and push it in a repository. Later when git-bug search for the git binary, this malicious executable can take priority and be executed.

Who is impacted

This issue happen on Windows and some other operating systems with a badly configured PATH.

All version prior to 0.7.2 are vulnerable to this issue.

Patches

Version 0.7.2 fix this issue. Users should update as soon as possible.

References

More details about this issue can be found here.

Fixed in

0.7.2

References

https://github.com/git-bug/git-bug/security/advisories/GHSA-m898-h4pm-pqfr
https://nvd.nist.gov/vuln/detail/CVE-2021-28955
https://github.com/MichaelMure/git-bug/pull/604
https://github.com/git-bug/git-bug
https://vuln.ryotak.me/advisories/18

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 3
patch 2

6 releases

Dependencies over time

per release

Release calendar

2025

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More