# CVE-2026-91986: gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection CVE-2026-91986 is fixed in 2 products on 1 platform, first by OPENSUSE-SU-2026:22204-1, released November 7, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-91986 - Priority: Routine - CVSS: 5.4 (Low) - EPSS: 0.0023 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 19, 2026 - Weakness: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91986 ## Description This update for gitoxide fixes the following issues: Changes in gitoxide: Update to version 0.60.0: * BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the prodash-render-tui feature are gone, line progress stays the only progress UI * Trace output is now independently configurable with a bounded -t/--trace counter, separate from verbose and progress rendering * Add gix worktree add (alias create) and worktree remove * Various security improvements and more consistent error handling across the plumbing crates - Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged. - Restore the explicit prodash feature dropped in the gix-utils 0.5.0 dep: migration, which broke workspace-wide cargo metadata --features as run by cargo-auditable. Update to version 0.59.0: * Ships gix-transport 0.60.0, which rejects NUL/LF in git-daemon connect requests: drops the backported fix for CVE-2026-91986 (boo#1281749), now fixed upstream * gix-transport-reject-control-bytes.patch * New gix editor command with Git-compatible selection * Raise the Rust floor to 1.88 (upstream MSRV, dua-core) - Refresh the vendored dependencies. The linked graph still carries MPL-2.0 only (uluru, option-ext); the License tag is unchanged. Update to 0.58.0: * gix tix is now the full gix-tix platform embedded in the plumbing command instead of a second parser and dispatcher, so standalone and plumbing invocations behave alike and amend and spill are reachable through gix tix * tix decorates commits checked out by other main or linked worktrees with light-blue name@ labels, keeps the marker for the checkout it was opened from, and watches linked HEAD and worktree membership so the decorations stay current * tix gained -w/--worktrees to add every resolved worktree HEAD to the traversal tips without weakening hidden-revision exclusions * gix tix no longer accepts --screen: the interactive history always owns the alternate screen, so the automatic and half-screen modes were removed - Refresh the vendored dependencies. The linked graph gains a second MPL-2.0 crate, option-ext, reached through the directories and dirs-sys crates that gix-tix newly depends on; the License tag already covers MPL-2.0 and is unchanged. Update to 0.57.0: * Add gix clone --revision, and PrepareFetch::with_revision(), for cloning a single revision named by a full ref, HEAD or a full object id: HEAD is detached to the fetched commit, no ordinary refs are created, no fetch refspec is persisted and tag following is disabled * Fix a panic when a full object id was passed to with_ref_name(), which produced an object-id refspec mapping that clone expected to be named * Rewrite relative date parsing to follow git: several count and unit pairs are applied in input order, as in "2 days 3 hours ago", counts may be spelled out, any non-alphanumeric byte separates the parts, the trailing "ago" is optional, and a leading "@" may introduce a timestamp. Month and year steps now walk the calendar fields, so a day past the end of the shorter target month rolls over into the following month * gix commit verify now checks signatures through the library rather than spawning gpg itself, so the configured gpg program is honoured and an invalid or untrusted signature is reported as such * Fix the conflict stage labels printed by gix revision explain, which called stage 0 "base"; they are now unconflicted, base, ours and theirs * Reject a TREE index extension whose child entry counts overflow instead of wrapping while verifying them * Replace the jwalk directory walker with dua-core - Refresh the vendored dependencies. The licence set is unchanged: re-derived over the new vendor tree, uluru (MPL-2.0) is still the only copyleft crate linked into the binaries, and the new dua-core dependency is MIT. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | gitoxide opensuse-leap 16.0 | 0.60.0-bp160.1.1 | [OPENSUSE-SU-2026:22126-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22126-1.md) | Nov 7, 2026 | | Linux | stgit opensuse-leap 16.0 | 2.7.0-bp160.1.1 | [OPENSUSE-SU-2026:22204-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22204-1.md) | Nov 7, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.