Executive brief
gitoxide is a Rust library that reads and manages Git repositories. A vulnerability allows attackers to craft malicious repository files that cause gitoxide to read configuration files from arbitrary locations on disk with full trust, potentially exposing embedded credentials. The flaw combines incomplete path traversal checks with flawed trust inheritance when opening submodules.
Technical details
The vulnerability involves three interconnected issues: (1) the submodule name validation function only checks the first occurrence of ".." using find(), allowing bypasses like "a..b/../../../.git/" to pass; (2) this validation is never called in production code paths that construct filesystem paths from submodule names; and (3) Submodule::open() inherits the parent repository's git_dir_trust setting (Trust::Full) without re-verifying ownership, causing traversed paths to be opened with full trust. An attacker can craft a .gitmodules file with a crafted submodule name that path-traverses to sibling git directories, which are then parsed with full trust, exposing credentials and other sensitive configuration. The attack requires user interaction (submodule operations) but no authentication.
Affected products
- GitoxideLabs gix <= 0.72.0
- GitoxideLabs gix-validate <= 0.10.0
Timeline
- 2026-04-25: disclosed: GitHub Security Advisory GHSA-p3hw-mv63-rf9w published
- 2026-08-28: advisory: CVE-2026-82253 published on NVD
- 2026-04-25: patched: gix 0.82.0 and gix-validate 0.11.1 released with fixes