CVE-2026-82249
Last modified
CVE-2026-82249 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL..
Description
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| GitoxideLabs | gitoxide | < 0.38.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-82249?
How severe is CVE-2026-82249?
How do I fix CVE-2026-82249?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82243Budibase Server before 3.41.3 contains a server-side request…7.6
- CVE-2026-82244Budibase versions before 3.41.3 contain a remote code execut…9.1
- CVE-2026-82245Budibase before 3.41.3 fails to enforce role-based authoriza…8.1
- CVE-2026-82246Budibase Server before 3.41.3 contains a server-side request…7.1
- CVE-2026-82247gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a…7.5
- CVE-2026-82248gix-worktree-state before 0.33.0 (part of gitoxide) allows w…5.3
- CVE-2026-8225A vulnerability was identified in Open5GS up to 2.7.7. This …7.5
- CVE-2026-82250gitoxide gix-packetline versions before 0.21.5 contain a pan…6.5
- CVE-2026-82251gitoxide before 0.52.1 fails to validate submodule names fro…7.5
- CVE-2026-82252gitoxide before 0.52.1 follows symlinks when reading the wor…7.5
- CVE-2026-82253gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10…7.5
- CVE-2026-82254gitoxide before 0.69.0 contains unchecked array indexing in …7.5
Are you affected by CVE-2026-82249?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST