Executive brief
gitoxide is a Rust library that parses and manages Git repositories, including submodule configurations. This vulnerability allows attackers to craft malicious submodule names containing traversal sequences (like "../../../") that escape the intended .git/modules directory and redirect operations to arbitrary repositories outside the project. An attacker can trick the library into checking the existence of or opening a repository at an attacker-controlled path, potentially enabling inspection of sensitive repository data or repository confusion attacks.
Technical details
The vulnerability is a path-traversal issue (CWE-22) in how gitoxide derives submodule git directories from unvalidated submodule names in .gitmodules configuration. The code constructs the submodule path as common_dir/modules/<submodule_name> without validating or sanitizing the name, allowing traversal segments like "../" to escape the modules root. When state() or open() functions are called, they operate on the attacker-controlled path instead of the intended location within .git/modules. The attack requires a malicious .gitmodules file in a repository (typically delivered via git clone), but no authentication or user interaction beyond cloning. Patches are available in gitoxide 0.52.1 and 0.82.
Affected products
- GitoxideLabs gitoxide before 0.52.1 (all versions >= 0) and before 0.82 (all versions >= 0)
Timeline
- 2026-04-25: disclosed: GitHub Security Advisory GHSA-fr8x-3vfx-f45h published
- 2026-08-28: advisory: CVE-2026-82251 assigned and published on NVD
- 2026: patched: Fixed in gitoxide 0.52.1 and 0.82