CVE-2026-82252: gitoxide symlink following in .gitmodules file

CVE-2026-82252 · Severity: high · CVSS 7.5 · Published 2026-08-28

gitoxide is a Git implementation library used to manage source code repositories. A flaw in how it reads submodule configuration allows an attacker to trick the software into reading and parsing files from outside the repository tree by exploiting symlinks. This could allow an attacker to inject malicious submodule metadata (URLs, paths, names) that the application believes came from the repository, potentially leading to unauthorized code execution or data exposure if the application uses these values to clone or fetch code.

Technologies: gitoxide (crates.io), gix (crates.io), GitoxideLabs Gitoxide. Vendors: crates.io, GitoxideLabs.

Quick answers

Is CVE-2026-82252 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82252 being exploited in the wild.
How severe is CVE-2026-82252?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
gitoxide (crates.io) SEMVER:introduced=0,fixed=0.52.1; gix (crates.io) SEMVER:introduced=0,fixed=0.83.0; GitoxideLabs Gitoxide before 0.52.1.
Is there a fix for CVE-2026-82252?
Yes. gitoxide (crates.io): upgrade to 0.52.1 or later; gix (crates.io): upgrade to 0.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82252 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82252?
Check whether you run gitoxide (crates.io), gix (crates.io) or GitoxideLabs Gitoxide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitoxide (crates.io): upgrade to 0.52.1 or later
    cargo update -p gitoxide
  • gix (crates.io): upgrade to 0.83.0 or later
    cargo update -p gix

Technical details

The vulnerability is a symlink-following flaw (CWE-59) in gitoxide's Repository::submodules() API. When loading submodule configuration from the worktree .gitmodules file, the code uses std::fs::read() which automatically follows symlinks without validation. An attacker can create a malicious repository with a symlinked .gitmodules pointing to an arbitrary external file, causing gitoxide to parse out-of-repository bytes as submodule metadata. The attack requires no authentication and is remotely exploitable when a user clones or accesses a malicious repository. The flaw exposes attacker-controlled name, path, and url fields in submodule objects, enabling metadata injection across repository boundaries. Patches are available in gitoxide 0.52.1+ and gix 0.82+.

Affected products

  • GitoxideLabs gitoxide before 0.52.1
  • GitoxideLabs gix before 0.82

Identifiers

  • CVE-2026-82252
  • GHSA-pg4w-g64p-qwhj

Timeline

  • 2026-04-25: disclosed
  • 2026-08-28: advisory: CVE-2026-82252 published
  • 2026-04-25: patched: Patches released: gitoxide 0.52.1+, gix 0.82+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.