CVE-2026-82253: gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's gitdirtrust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gixto a version that resolves this vulnerability.Fixed in 0.82.0 - Upgrade
Upgrade
gix-validateto a version that resolves this vulnerability.Fixed in 0.11.1 - Compensating control
If upgrading is not immediately possible, mitigate by preventing untrusted repositories (including crafted .gitmodules) from being processed by gitoxide, since validation in gix-validate (e.g., name.find(b"..")) is not invoked in production code paths.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Tools built on affected gitoxide crates are exposed when they process an attacker-controlled repository containing a malicious .gitmodules file. The issue affects gix versions through 0.72.0 and gix-validate versions through 0.10.0.
What does an attacker need to exploit it?
An attacker needs to provide a repository with a crafted submodule name in .gitmodules, such as one using traversal components after an initial non-blocked '..' occurrence. No authentication or user interaction is required according to the supplied CVSS vector.
What is the practical impact?
A malicious submodule name can cause the victim tool to read arbitrary Git repository configuration with full trust. This can expose embedded credentials and bypass safe-directory protections because ownership verification is skipped under inherited full trust.
Is submodule-name validation an effective mitigation in the affected releases?
No. The described validation checks only the first occurrence of '..' and is not invoked in production code paths, so it does not prevent exploitation in the affected software.
Which versions contain the fix?
The issue is fixed in gix 0.82.0 and gix-validate 0.11.1.