Skip to content
OpenAdvisories

Package · crates.io

jj-lib

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.8
    GHSA-794x-2rpg-rfgr

    Jujutsu does not have SHA-1 collision detection

    ### Summary Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. ### Details This is a result of the underlying [CVE-2025-31130 / GHSA-2…

    jj-lib jj-cli crates.io
  • Critical 9.3
    CVE-2024-51990

    Path traversal via crafted Git repositories in jj

    jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to up…

    martinvonz jj jj-lib crates.io