CVE-2026-82251: gitoxide path traversal in submodule name resolution

CVE-2026-82251 · Severity: high · CVSS 7.5 · Published 2026-08-28

gitoxide is a Rust library that parses and manages Git repositories, including submodule configurations. This vulnerability allows attackers to craft malicious submodule names containing traversal sequences (like "../../../") that escape the intended .git/modules directory and redirect operations to arbitrary repositories outside the project. An attacker can trick the library into checking the existence of or opening a repository at an attacker-controlled path, potentially enabling inspection of sensitive repository data or repository confusion attacks.

Technologies: gitoxide (crates.io), gix (crates.io), GitoxideLabs Gitoxide. Vendors: crates.io, GitoxideLabs.

Quick answers

Is CVE-2026-82251 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82251 being exploited in the wild.
How severe is CVE-2026-82251?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
gitoxide (crates.io) SEMVER:introduced=0,fixed=0.52.1; gix (crates.io) SEMVER:introduced=0,fixed=0.83.0; GitoxideLabs Gitoxide before 0.52.1 (all versions >= 0) and before 0.82 (all versions >= 0).
Is there a fix for CVE-2026-82251?
Yes. gitoxide (crates.io): upgrade to 0.52.1 or later; gix (crates.io): upgrade to 0.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82251 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82251?
Check whether you run gitoxide (crates.io), gix (crates.io) or GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitoxide (crates.io): upgrade to 0.52.1 or later
    cargo update -p gitoxide
  • gix (crates.io): upgrade to 0.83.0 or later
    cargo update -p gix

Technical details

The vulnerability is a path-traversal issue (CWE-22) in how gitoxide derives submodule git directories from unvalidated submodule names in .gitmodules configuration. The code constructs the submodule path as common_dir/modules/<submodule_name> without validating or sanitizing the name, allowing traversal segments like "../" to escape the modules root. When state() or open() functions are called, they operate on the attacker-controlled path instead of the intended location within .git/modules. The attack requires a malicious .gitmodules file in a repository (typically delivered via git clone), but no authentication or user interaction beyond cloning. Patches are available in gitoxide 0.52.1 and 0.82.

Affected products

  • GitoxideLabs gitoxide before 0.52.1 (all versions >= 0) and before 0.82 (all versions >= 0)

Identifiers

  • CVE-2026-82251
  • GHSA-fr8x-3vfx-f45h

Timeline

  • 2026-04-25: disclosed: GitHub Security Advisory GHSA-fr8x-3vfx-f45h published
  • 2026-08-28: advisory: CVE-2026-82251 assigned and published on NVD
  • 2026: patched: Fixed in gitoxide 0.52.1 and 0.82

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.