# GHSA-g27r-r6ph-vf5r: sequoia-git has broken hard revocation handling

> An attacker can bypass hard revocation checks in sq-git by stripping revocations from a merge request, requiring user interaction to merge.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 21 Apr 2026
- **Also known as:** RUSTSEC-2026-0109

## What is GHSA-g27r-r6ph-vf5r?

GHSA-g27r-r6ph-vf5r is a vulnerability in sequoia-git, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations.  Because parsing a policy is expensive
and a project's policy rarely changes, `sq-git` has an optimization to only check a policy if it hasn't checked it before.  It does this by maintaining a set of policies that it had already seen keyed on the policy's hash.  Unfortunately, due to a bug the hash was truncated to be 0 bytes and thus only hard revocations in the target commit were considered.  Normally this is not a problem as hard revocations are not removed from the signing policy.

An attacker could nevertheless exploit this flaw as follows. Consider Alice and Bob who maintain a project together.  If Bob's
certificate is compromised and Bob issues a hard revocation, Alice can add it to the project's signing policy.  An attacker who has
access to Bob's key can then create a merge request that strips the hard revocation.  If Alice merges Bob's merge request, then
the latest commit will not carry the hard revocation, and `sq-git` will not see the hard revocation when authenticating that commit or any following commits.

Note: for this attack to be successful, Alice needs to be tricked into merging the malicious MR.  If Alice is reviewing MRs, then she is likely to notice changes to the signing policy.

Reported-by: Hassan Sheet

## Which versions are affected by GHSA-g27r-r6ph-vf5r?

3 open source packages ship an affected version, including sequoia-git.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `sequoia-git` | crates.io | All versions | 0.6.0 |
| `sequoia-git` | crates.io | All versions | 0.6.0 |
| `sequoia-git` | crates.io | From 0.0.0-0 | 0.6.0 |

## How do I fix GHSA-g27r-r6ph-vf5r?

Upgrade sequoia-git to 0.6.0 or later.

## Is GHSA-g27r-r6ph-vf5r being exploited?

There is no known exploitation of GHSA-g27r-r6ph-vf5r in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-g27r-r6ph-vf5r and fix it if it is affected.

What it is: GHSA-g27r-r6ph-vf5r is a vulnerability in sequoia-git, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-g27r-r6ph-vf5r in the wild and no public exploit code.

Affected packages and fixed versions:
- sequoia-git (crates.io): affected all versions; fixed in 0.6.0
- sequoia-git (crates.io): affected all versions; fixed in 0.6.0
- sequoia-git (crates.io): affected from 0.0.0-0; fixed in 0.6.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/ (Markdown: https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-g27r-r6ph-vf5r

---
From sbomify Insights: https://insights.sbomify.com/GHSA-g27r-r6ph-vf5r/
Summaries are generated and may contain mistakes; the official description above is the record.