CVE-2026-82252: gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitoxideto a version that resolves this vulnerability.Fixed in 0.52.1 - Configuration
Ensure gitoxide is configured/updated so it does not follow symlinks when reading the worktree .gitmodules file, preventing out-of-repository bytes from being parsed into submodule metadata.
gitoxide .gitmodules symlink handling = do not follow symlinks when reading the worktree .gitmodules file
Event History
Frequently Asked Questions
Which versions are affected?
gitoxide versions before 0.52.1 are affected. Updating to 0.52.1 or later addresses the vulnerable behavior.
What does an attacker need to exploit this issue?
An attacker needs to provide a malicious repository containing a worktree .gitmodules entry that is a symlink to a file outside the repository tree. No authentication or user interaction is indicated by the supplied vector.
What data can be injected through exploitation?
gitoxide can parse external file contents as submodule configuration, exposing attacker-controlled submodule name, path, and URL values. The issue affects confidentiality; the provided vector does not indicate integrity or availability impact.
How can I identify potentially affected repositories before patching?
Inspect untrusted repositories for a .gitmodules file that is a symbolic link, particularly one resolving outside the repository worktree. Such a repository can cause gitoxide to read external bytes as submodule metadata.