Executive brief
gitoxide is a Git implementation library used to manage source code repositories. A flaw in how it reads submodule configuration allows an attacker to trick the software into reading and parsing files from outside the repository tree by exploiting symlinks. This could allow an attacker to inject malicious submodule metadata (URLs, paths, names) that the application believes came from the repository, potentially leading to unauthorized code execution or data exposure if the application uses these values to clone or fetch code.
Technical details
The vulnerability is a symlink-following flaw (CWE-59) in gitoxide's Repository::submodules() API. When loading submodule configuration from the worktree .gitmodules file, the code uses std::fs::read() which automatically follows symlinks without validation. An attacker can create a malicious repository with a symlinked .gitmodules pointing to an arbitrary external file, causing gitoxide to parse out-of-repository bytes as submodule metadata. The attack requires no authentication and is remotely exploitable when a user clones or accesses a malicious repository. The flaw exposes attacker-controlled name, path, and url fields in submodule objects, enabling metadata injection across repository boundaries. Patches are available in gitoxide 0.52.1+ and gix 0.82+.
Affected products
- GitoxideLabs gitoxide before 0.52.1
- GitoxideLabs gix before 0.82
Timeline
- 2026-04-25: disclosed
- 2026-08-28: advisory: CVE-2026-82252 published
- 2026-04-25: patched: Patches released: gitoxide 0.52.1+, gix 0.82+