CVE-2026-82249: fallo de gravedad baja en GitoxideLabs gitoxide
gitoxide before 0.38.2 Credential Helper Protocol Field Injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.3epss 0.3%
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
GitoxideLabs · gitoxideCVEs relacionadas — GitoxideLabs gitoxide
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-82253HIGHgitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassEPSS 0.7%CVE-2026-123532HIGHgix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC ProbeEPSS 0.6%CVE-2026-82252HIGHgitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesEPSS 0.5%CVE-2026-82251HIGHgitoxide before 0.52.1 Path Traversal via Submodule NameEPSS 0.5%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.5%CVE-2026-82250HIGHgitoxide gix-packetline before 0.21.5 Denial of ServiceEPSS 0.4%