CVE-2026-82252: high-severity vulnerability in GitoxideLabs gitoxide
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
GitoxideLabs · gitoxideRelated CVEs — GitoxideLabs gitoxide
In the same product, most dangerous first.
CVE-2026-82253HIGHgitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassEPSS 0.7%CVE-2026-82251HIGHgitoxide before 0.52.1 Path Traversal via Submodule NameEPSS 0.5%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.5%CVE-2026-82250HIGHgitoxide gix-packetline before 0.21.5 Denial of ServiceEPSS 0.4%CVE-2026-82247HIGHgitoxide before 0.37.1 HTTP Basic credential leak via URL parsingEPSS 0.4%CVE-2026-82255HIGHgitoxide 0.25.4 HTTP Credential Leak via RedirectEPSS 0.4%