# CVE-2026-91986: gitoxide gix-transport CR/LF/NUL injection in git-daemon connect request

Source: https://junglewise.ai/threats/cve-2026-91986-gitoxide-gix-transport-cr-lf-nul-injection-in-git-daemon-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91986 · Severity: medium · CVSS 5.4 · Published 2026-09-15

gitoxide's gix-transport library is a component that handles git protocol connections. A flaw in how it constructs git-daemon connection requests allows attackers to inject special characters via malicious git URLs, enabling virtual host spoofing or log injection attacks. An attacker could exploit this through a malicious git submodule URL or network interception to redirect a user to an attacker-controlled repository.

Technologies: [GitoxideLabs Gix-Transport](https://junglewise.ai/threats/technologies/gix-transport). Vendors: [GitoxideLabs](https://junglewise.ai/threats/vendors/gitoxidelabs).

## Quick answers

**Is CVE-2026-91986 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91986 being exploited in the wild.

**How severe is CVE-2026-91986?** Medium severity, with a CVSS score of 5.4, published 15 September 2026.

**Which products and versions are affected?** GitoxideLabs Gix-Transport before 0.59.2.

**Is there a fix for CVE-2026-91986?** A patch was published on 2026-09-02: Fix released in gix-transport 0.59.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91986 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-91986?** Check whether you run GitoxideLabs Gix-Transport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CWE-74 injection flaw in gix-transport versions before 0.59.2. The root cause is that the library's message::connect function writes URL path and host fields into the git-daemon protocol request without filtering control characters (NUL, CR, LF). Although the initial URL parser checks percent-encoding validity, the subsequent percent-decode operation accepts NUL/CR/LF as valid UTF-8, allowing encoded control bytes (%00, %0A, %0D) to survive into the decoded path. An attacker controlling part of a git:// URL can inject raw NUL bytes to add extra NUL-delimited protocol fields (such as host=attacker.com) that precede the legitimate host parameter, achieving virtual-host spoofing on git-daemon. The attack requires user interaction (the victim must clone or fetch from a malicious URL). The vulnerability is patched in version 0.59.2 and later.

## Affected products

- GitoxideLabs gix-transport before 0.59.2

## Timeline

- 2026-09-01: disclosed: GitHub security advisory published
- 2026-09-02: patched: Fix released in gix-transport 0.59.2

## References

- [https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-rc7h-wp5f-w3g5](https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-rc7h-wp5f-w3g5)
- [https://www.vulncheck.com/advisories/gitoxide-gix-transport-before-0.59.2-cr-lf-nul-injection](https://www.vulncheck.com/advisories/gitoxide-gix-transport-before-0.59.2-cr-lf-nul-injection)

## Related threats

- [gitoxide HTTP credential leak via redirect in curl backend](https://junglewise.ai/threats/cve-2026-82255-gitoxide-http-credential-leak-via-redirect-in-curl-backend)
- [gitoxide gix-url URL parsing authority termination bypass](https://junglewise.ai/threats/cve-2026-82247-gitoxide-gix-url-url-parsing-authority-termination-bypass)