Sign in Sign up

github.com/michaelmure/git-bug

Distributed, offline-first bug tracker integrated in git

Activity

Latest release: 1mo ago
Total releases: 7
Cadence: ~8 months
Last 12 months: 1

Reach

Stars: 10.7k

Details

First release: Mar 21, 2021

Releases

Version	Released
`v0.11.0` minor	Sep 22, 2026
`v0.10.1` patch	May 19, 2025
`v0.10.0` minor	May 18, 2025
`v0.9.0` minor	May 12, 2025
`v0.8.1` patch	May 05, 2025
`v0.8.0` minor	Nov 20, 2022
`v0.7.2` initial	Mar 21, 2021

Repository

michaelmure/git-bug

Forks: 332
Open issues: 132
Language: Go
: 6.1/ 10

bugtracker
git
decentralized-application
distributed-systems
gitdb

Dependencies (34)

Depends on

v0.11.0

Supply-chain exposure

Vulnerable dependencies

1 of 34

golang.org/x/crypto 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

CVE-2021-28955 GHSA-m898-h4pm-pqfr May 25, 2021

Arbitrary code execution due to an uncontrolled search path for the git binary

9.8 / 10
Critical
Network Low None None Unchanged High High High

Impact

The go language recently addressed a security issue in the way that binaries are found before being executed. Some operating systems like Windows persist to have the current directory being part of the default search path, and having priority over the system-wide path.

This means that it's possible for a malicious user to craft for example a git.bat command, commit it and push it in a repository. Later when git-bug search for the git binary, this malicious executable can take priority and be executed.

Who is impacted

This issue happen on Windows and some other operating systems with a badly configured PATH.

All version prior to 0.7.2 are vulnerable to this issue.

Patches

Version 0.7.2 fix this issue. Users should update as soon as possible.

References

More details about this issue can be found here.

Fixed in

0.7.2

References

https://github.com/git-bug/git-bug/security/advisories/GHSA-m898-h4pm-pqfr
https://nvd.nist.gov/vuln/detail/CVE-2021-28955
https://github.com/MichaelMure/git-bug/pull/604
https://github.com/git-bug/git-bug
https://vuln.ryotak.me/advisories/18

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 4
patch 2

7 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More