CVE-2026-123532: gitoxide gix-fs NTLM credential disclosure via Windows symlink UNC probe

CVE-2026-123532 · Severity: medium · CVSS 6.5 · Published 2026-11-08

gitoxide is a Git client library used to clone and manage repositories. On Windows systems with symlink creation enabled, a crafted repository containing malicious symbolic links can trick the checkout process into connecting to an attacker-controlled SMB server, automatically disclosing the victim's Windows username, domain, and password hash. An attacker only needs to publish a booby-trapped repository for victims to clone it and leak credentials.

Technologies: GitoxideLabs Gitoxide. Vendors: GitoxideLabs.

Quick answers

Is CVE-2026-123532 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123532 being exploited in the wild.
How severe is CVE-2026-123532?
Medium severity, with a CVSS score of 6.5, published 8 November 2026.
Which products and versions are affected?
GitoxideLabs Gitoxide before 0.24.1.
Is there a fix for CVE-2026-123532?
Yes: fixed in gitoxide 0.24.1. Until then: On Windows systems, disable symbolic link creation during checkout, or restrict checkout operations to trusted repositories only, until gitoxide can be upgraded to version 0.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123532 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123532?
Check whether you run GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: gitoxide 0.24.1

On Windows systems, disable symbolic link creation during checkout, or restrict checkout operations to trusted repositories only, until gitoxide can be upgraded to version 0.24.1 or later.

Technical details

The vulnerability exists in gix-fs::symlink::create on Windows, which calls std::fs::metadata() (via is_dir()) on an untrusted symlink target to determine whether to create a file or directory symlink. An attacker-controlled UNC path (such as \\attacker-host\share) in a symlink target is resolved as an SMB connection, triggering automatic NTLM authentication that leaks the username, domain, and NTLMv2 response hash. The flaw is that Path::join on Windows can be bypassed with UNC prefixes, allowing the target to escape the worktree base and reach the attacker's specified network location.

Affected products

  • GitoxideLabs gitoxide before 0.24.1

Timeline

  • 2026-10-22: disclosed
  • 2026-11-08: advisory
  • 2026-10-22: patched: Patched version 0.24.1 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.