Quick answers
- Is CVE-2026-91986 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91986 being exploited in the wild.
- How severe is CVE-2026-91986?
- Medium severity, with a CVSS score of 5.4, published 15 September 2026.
- Which products and versions are affected?
- GitoxideLabs Gix-Transport before 0.59.2.
- Is there a fix for CVE-2026-91986?
- A patch was published on 2026-09-02: Fix released in gix-transport 0.59.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91986 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-91986?
- Check whether you run GitoxideLabs Gix-Transport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a CWE-74 injection flaw in gix-transport versions before 0.59.2. The root cause is that the library's message::connect function writes URL path and host fields into the git-daemon protocol request without filtering control characters (NUL, CR, LF). Although the initial URL parser checks percent-encoding validity, the subsequent percent-decode operation accepts NUL/CR/LF as valid UTF-8, allowing encoded control bytes (%00, %0A, %0D) to survive into the decoded path. An attacker controlling part of a git:// URL can inject raw NUL bytes to add extra NUL-delimited protocol fields (such as host=attacker.com) that precede the legitimate host parameter, achieving virtual-host spoofing on git-daemon. The attack requires user interaction (the victim must clone or fetch from a malicious URL). The vulnerability is patched in version 0.59.2 and later.
Affected products
- GitoxideLabs gix-transport before 0.59.2
Timeline
- 2026-09-01: disclosed: GitHub security advisory published
- 2026-09-02: patched: Fix released in gix-transport 0.59.2