CVE-2026-82251
Last modified
CVE-2026-82251 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories..
Description
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| GitoxideLabs | gitoxide | < 0.52.1 |
| GitoxideLabs | gitoxide | < 0.82 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-82251?
How severe is CVE-2026-82251?
How do I fix CVE-2026-82251?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82246Budibase Server before 3.41.3 contains a server-side request…7.1
- CVE-2026-82247gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a…7.5
- CVE-2026-82248gix-worktree-state before 0.33.0 (part of gitoxide) allows w…5.3
- CVE-2026-82249gitoxide before 0.38.2 fails to validate carriage return cha…3.1
- CVE-2026-8225A vulnerability was identified in Open5GS up to 2.7.7. This …7.5
- CVE-2026-82250gitoxide gix-packetline versions before 0.21.5 contain a pan…6.5
- CVE-2026-82252gitoxide before 0.52.1 follows symlinks when reading the wor…7.5
- CVE-2026-82253gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10…7.5
- CVE-2026-82254gitoxide before 0.69.0 contains unchecked array indexing in …7.5
- CVE-2026-82255gitoxide versions from 0.25.4 contain an HTTP credential lea…6.8
- CVE-2026-82256SvelteKit before 2.69.1 fails to properly validate remote fo…5.3
- CVE-2026-82257SvelteKit versions before 2.69.1 contain a prototype polluti…4.3
Are you affected by CVE-2026-82251?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST