GHSA-794x-2rpg-rfgr: 
Rust vulnerability analysis and mitigation

Jujutsu versions 0.28.0 and earlier contain a vulnerability (GHSA-794x-2rpg-rfgr) where SHA-1 hash collision detection is not implemented. This security issue stems from the use of gitoxide library versions that lack proper collision detection mechanisms in their SHA-1 hash implementations (GitHub Advisory).

The vulnerability is related to the underlying CVE-2025-31130/GHSA-2frx-2596-x5r6 in the gitoxide library that Jujutsu uses for Git repository interactions. The issue has been assigned a CVSS v3.1 base score of 6.8 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N. The vulnerability is classified under CWE-328 (GitHub Advisory).

The vulnerability could allow an attacker with sufficient resources to create two distinct Git objects with identical hashes through SHA-1 collision attacks. As of 2020, the cost for mounting such attacks was estimated at $45,000 for a chosen-prefix collision or $11,000 for a classical collision, with projections suggesting costs below $10,000 by 2025. This could be exploited to disguise malicious repository contents or potentially exploit Jujutsu's internal logic (GitHub Advisory).

The vulnerability has been patched in Jujutsu version 0.28.1 for both jj-cli and jj-lib packages. Users should upgrade to this version or later to receive the security fix (GitHub Advisory).