Is CVE-2026-82249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82249 being exploited in the wild.

How severe is CVE-2026-82249?

Low severity, with a CVSS score of 3.1, published 28 August 2026.

Which products and versions are affected?

GitoxideLabs Gitoxide before 0.38.2.

Is there a fix for CVE-2026-82249?

A patch was published on 2026-08-28: Version 0.38.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82249?

Check whether you run GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82249: gitoxide credential helper protocol field injection via carriage return

CVE-2026-82249 · Severity: low · CVSS 3.1 · Published 2026-08-28

gitoxide is a Git implementation library used by applications and developers to interact with Git repositories. The vulnerability allows an attacker to inject forged credential requests by embedding carriage return characters in URLs, potentially causing credential helpers to return passwords and authentication tokens for trusted hosts instead of the attacker's target. This could expose sensitive credentials if the victim application logs or returns credentials from the attacked workflow.

Technologies: GitoxideLabs Gitoxide. Vendors: GitoxideLabs.

Quick answers

Is CVE-2026-82249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82249 being exploited in the wild.
How severe is CVE-2026-82249?: Low severity, with a CVSS score of 3.1, published 28 August 2026.
Which products and versions are affected?: GitoxideLabs Gitoxide before 0.38.2.
Is there a fix for CVE-2026-82249?: A patch was published on 2026-08-28: Version 0.38.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82249?: Check whether you run GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation issue (CWE-116) in gitoxide's credential helper protocol serialization. The Context::write_to() function in gix-credentials validates URL values to reject NUL (0x00) and LF (0x0A) characters but fails to reject CR (0x0D), allowing bare carriage returns to pass through unchecked. When serialized to the helper line protocol, an attacker-controlled URL such as `https://evil.example\rhost=trusted.example\rprotocol=https` can be parsed by CR-sensitive credential helpers as multiple fields, causing them to return credentials for the injected trusted host instead of the attacker's domain. Exploitation requires an unauthenticated network attacker to supply a malicious URL to a gitoxide caller and depends on a credential helper that treats CR as a line terminator; helpers that split only on LF are not affected. The patch adds CR validation alongside NUL and LF checks in the validation function.

Affected products

GitoxideLabs gitoxide before 0.38.2

Timeline

2026-07-15: disclosed
2026-08-28: patched: Version 0.38.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.