GHSA-794x-2rpg-rfgr is a medium-severity (CVSS 6.8) vulnerability in jj-lib. A fix is available for jj-lib — see the affected versions and patch details below.
Jujutsu does not have SHA-1 collision detection
Real-World Exposure
jj-lib🦀jj-cliReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks.
Details
This is a result of the underlying CVE-2025-31130 / GHSA-2frx-2596-x5r6 vulnerability in the gitoxide library Jujutsu uses to interact with Git repositories; see that advisory for technical details. This separate advisory is being issued due to the downstream impact on users of Jujutsu.
Impact
An attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in Jujutsu’s logic to cause further vulnerabilities.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | jj-lib | all versions | 0.28.1cargo update -p jj-lib --precise 0.28.1 |
| 🦀crates.io | jj-cli | all versions | 0.28.1cargo update -p jj-cli --precise 0.28.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jj-lib, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update jj-lib to 0.28.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-794x-2rpg-rfgr is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-794x-2rpg-rfgr can be triaged on real exposure rather than presence alone.
Tailored to GHSA-794x-2rpg-rfgr. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-794x-2rpg-rfgr in your dependencies?
O3 Security finds GHSA-794x-2rpg-rfgr across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.