Executive brief
gitoxide is a Rust-based Git implementation used for version control operations. Its URL parsing library fails to properly identify where the network authority ends in HTTP URLs, allowing an attacker controlling redirect responses to trick gitoxide into sending a user's HTTP Basic authentication credentials (often a personal access token) to an unintended server.
Technical details
The gix-url crate's hand-rolled URL parser does not treat '?' or '#' characters as terminators of the authority component, violating RFC 3986 §3.2. This causes URLs like "http://attacker?@legitimate.com/repo" to incorrectly parse "legitimate.com" as the host instead of "attacker". The vulnerability becomes exploitable through gix-transport's HTTP redirect handler, which compares hosts using gix-url's parser. An attacker can craft a Location header with the form "<attacker-authority>?@<original-authority>" to bypass the redirect identity guard (can_reuse_identity), causing gitoxide to send HTTP Basic Authorization headers to the attacker's server. This affects gix-url <= 0.32.0 (fixed in 0.37.1) and gix-transport <= 0.49.0 (fixed in 0.58.1). The vulnerability is reachable by default since http.followRedirects defaults to FollowRedirects::Initial.
Affected products
- GitoxideLabs gix-url <= 0.32.0
- GitoxideLabs gix-transport <= 0.49.0
Timeline
- 2026-08-28: disclosed: CVE-2026-82247 published
- 2026: patched: gix-url fixed in 0.37.1; gix-transport fixed in 0.58.1