GHSA-794X-2RPG-RFGR

Jujutsu does not have SHA-1 collision detection

Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks.

Details

This is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu.

An attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities.

GHSA-794X-2RPG-RFGR has a CVSS score of 6.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.28.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

1. What is GHSA-794X-2RPG-RFGR? GHSA-794X-2RPG-RFGR is a medium-severity security vulnerability in jj-lib (rust), affecting versions < 0.28.1. It is fixed in 0.28.1.
2. How severe is GHSA-794X-2RPG-RFGR? GHSA-794X-2RPG-RFGR has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by GHSA-794X-2RPG-RFGR?
   • jj-lib (rust) (versions < 0.28.1)
   • jj-cli (rust) (versions < 0.28.1)
4. Is there a fix for GHSA-794X-2RPG-RFGR? Yes. GHSA-794X-2RPG-RFGR is fixed in 0.28.1. Upgrade to this version or later.
5. Is GHSA-794X-2RPG-RFGR exploitable, and should I be worried? Whether GHSA-794X-2RPG-RFGR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-794X-2RPG-RFGR is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-794X-2RPG-RFGR?
   • Upgrade jj-lib to 0.28.1 or later
   • Upgrade jj-cli to 0.28.1 or later

Other vulnerabilities in jj-lib