Executive brief
gitoxide's gix-transport library is a component that handles git protocol connections. A flaw in how it constructs git-daemon connection requests allows attackers to inject special characters via malicious git URLs, enabling virtual host spoofing or log injection attacks. An attacker could exploit this through a malicious git submodule URL or network interception to redirect a user to an attacker-controlled repository.
Technical details
The vulnerability is a CWE-74 injection flaw in gix-transport versions before 0.59.2. The root cause is that the library's message::connect function writes URL path and host fields into the git-daemon protocol request without filtering control characters (NUL, CR, LF). Although the initial URL parser checks percent-encoding validity, the subsequent percent-decode operation accepts NUL/CR/LF as valid UTF-8, allowing encoded control bytes (%00, %0A, %0D) to survive into the decoded path. An attacker controlling part of a git:// URL can inject raw NUL bytes to add extra NUL-delimited protocol fields (such as host=attacker.com) that precede the legitimate host parameter, achieving virtual-host spoofing on git-daemon. The attack requires user interaction (the victim must clone or fetch from a malicious URL). The vulnerability is patched in version 0.59.2 and later.
Affected products
- GitoxideLabs gix-transport before 0.59.2
Timeline
- 2026-09-01: disclosed: GitHub security advisory published
- 2026-09-02: patched: Fix released in gix-transport 0.59.2