{"answers":{"affected":"3 open source packages ship an affected version, including sequoia-git.","exploited":"There is no known exploitation of GHSA-g27r-r6ph-vf5r in the wild and no public exploit code.","fix":"Upgrade sequoia-git to 0.6.0 or later.","what":"GHSA-g27r-r6ph-vf5r is a vulnerability in sequoia-git, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-g27r-r6ph-vf5r and fix it if it is affected.\n\nWhat it is: GHSA-g27r-r6ph-vf5r is a vulnerability in sequoia-git, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-g27r-r6ph-vf5r in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- sequoia-git (crates.io): affected all versions; fixed in 0.6.0\n- sequoia-git (crates.io): affected all versions; fixed in 0.6.0\n- sequoia-git (crates.io): affected from 0.0.0-0; fixed in 0.6.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/ (Markdown: https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/index.md)","id":"GHSA-g27r-r6ph-vf5r","markdown":"https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/index.md","name":"GHSA-g27r-r6ph-vf5r","record":{"aliases":["RUSTSEC-2026-0109"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust git library","requires_auth":"none","summary":"An attacker can bypass hard revocation checks in sq-git by stripping revocations from a merge request, requiring user interaction to merge.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations.  Because parsing a policy is expensive\nand a project's policy rarely changes, `sq-git` has an optimization to only check a policy if it hasn't checked it before.  It does this by maintaining a set of policies that it had already seen keyed on the policy's hash.  Unfortunately, due to a bug the hash was truncated to be 0 bytes and thus only hard revocations in the target commit were considered.  Normally this is not a problem as hard revocations are not removed from the signing policy.\n\nAn attacker could nevertheless exploit this flaw as follows. Consider Alice and Bob who maintain a project together.  If Bob's\ncertificate is compromised and Bob issues a hard revocation, Alice can add it to the project's signing policy.  An attacker who has\naccess to Bob's key can then create a merge request that strips the hard revocation.  If Alice merges Bob's merge request, then\nthe latest commit will not carry the hard revocation, and `sq-git` will not see the hard revocation when authenticating that commit or any following commits.\n\nNote: for this attack to be successful, Alice needs to be tricked into merging the malicious MR.  If Alice is reviewing MRs, then she is likely to notice changes to the signing policy.\n\nReported-by: Hassan Sheet","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"sequoia-git has broken hard revocation handling","id":"GHSA-g27r-r6ph-vf5r","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.6.0"],"introduced":["0"],"last_affected":[],"package":"sequoia-git","purl":null,"source":"GHSA-g27r-r6ph-vf5r"},{"ecosystem":"crates.io","fixed":["0.6.0"],"introduced":["0"],"last_affected":[],"package":"sequoia-git","purl":"pkg:cargo/sequoia-git","source":"GHSA-g27r-r6ph-vf5r"},{"ecosystem":"crates.io","fixed":["0.6.0"],"introduced":["0.0.0-0"],"last_affected":[],"package":"sequoia-git","purl":"pkg:cargo/sequoia-git","source":"RUSTSEC-2026-0109"}],"products":null,"published":"2026-04-21","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can bypass hard revocation checks in sq-git by stripping revocations from a merge request, requiring user interaction to merge.","url":"https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/"}