gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22126-1 advisory.

    Changes in gitoxide:

    Update to version 0.60.0:

      * BREAKING: remove the full-screen progress mode: the --progress         and --progress-keep-open flags and the prodash-render-tui         feature are gone, line progress stays the only progress UI
      * Trace output is now independently configurable with a bounded
        -t/--trace counter, separate from verbose and progress rendering
      * Add gix worktree add (alias create) and worktree remove
      * Various security improvements and more consistent error         handling across the plumbing crates
    - Refresh the vendored dependencies. The linked graph still carries       MPL-2.0 only (uluru, option-ext); the License tag is unchanged.

    - Restore the explicit prodash feature dropped in the gix-utils 0.5.0 dep:
      migration, which broke workspace-wide cargo metadata --features as       run by cargo-auditable.

    Update to version 0.59.0:

      * Ships gix-transport 0.60.0, which rejects NUL/LF in         git-daemon connect requests: drops the backported fix         for CVE-2026-91986 (boo#1281749), now fixed upstream
        * gix-transport-reject-control-bytes.patch
      * New gix editor command with Git-compatible selection
      * Raise the Rust floor to 1.88 (upstream MSRV, dua-core)

    - Refresh the vendored dependencies. The linked graph       still carries MPL-2.0 only (uluru, option-ext); the       License tag is unchanged.

    Update to 0.58.0:

      * gix tix is now the full gix-tix platform embedded in the plumbing         command instead of a second parser and dispatcher, so standalone         and plumbing invocations behave alike and amend and spill are         reachable through gix tix
      * tix decorates commits checked out by other main or linked         worktrees with light-blue name@ labels, keeps the marker for the         checkout it was opened from, and watches linked HEAD and worktree         membership so the decorations stay current
      * tix gained -w/--worktrees to add every resolved worktree HEAD to         the traversal tips without weakening hidden-revision exclusions
      * gix tix no longer accepts --screen: the interactive history always         owns the alternate screen, so the automatic and half-screen modes         were removed

    - Refresh the vendored dependencies. The linked graph gains a second       MPL-2.0 crate, option-ext, reached through the directories and       dirs-sys crates that gix-tix newly depends on; the License tag       already covers MPL-2.0 and is unchanged.

    Update to 0.57.0:

      * Add gix clone --revision, and PrepareFetch::with_revision(), for         cloning a single revision named by a full ref, HEAD or a full         object id: HEAD is detached to the fetched commit, no ordinary         refs are created, no fetch refspec is persisted and tag         following is disabled
      * Fix a panic when a full object id was passed to with_ref_name(),         which produced an object-id refspec mapping that clone expected         to be named
      * Rewrite relative date parsing to follow git: several count and         unit pairs are applied in input order, as in 2 days 3 hours         ago, counts may be spelled out, any non-alphanumeric byte         separates the parts, the trailing ago is optional, and a         leading @ may introduce a timestamp. Month and year steps now         walk the calendar fields, so a day past the end of the shorter         target month rolls over into the following month
      * gix commit verify now checks signatures through the library         rather than spawning gpg itself, so the configured gpg program         is honoured and an invalid or untrusted signature is reported         as such
      * Fix the conflict stage labels printed by gix revision explain,         which called stage 0 base; they are now unconflicted, base,         ours and theirs
      * Reject a TREE index extension whose child entry counts overflow         instead of wrapping while verifying them
      * Replace the jwalk directory walker with dua-core
    - Refresh the vendored dependencies. The licence set is unchanged:
      re-derived over the new vendor tree, uluru (MPL-2.0) is still the       only copyleft crate linked into the binaries, and the new dua-core       dependency is MIT.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21955-1 advisory.

    Changes in gitoxide:

    - CVE-2026-91986: gix-transport CR/LF/NUL injection into       git-daemon connect request via crafted git URL path,       allowing virtual-host spoofing (boo#1281749)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests,     allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-     delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.
    (CVE-2026-91986)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370426	openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:22126-1)	Nessus	SuSE Local Security Checks	Local	medium
350773	openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21955-1)	Nessus	SuSE Local Security Checks	Local	medium
345970	Linux Distros Unpatched Vulnerability : CVE-2026-91986	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-91986

medium

Tenable Plugins

medium

medium

medium