CVE-2026-82253

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

• CWE-22

• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-p3hw-mv63-rf9w
• https://www.vulncheck.com/advisories/gitoxide-before-0.82.0-path-traversal-via-submodule-name-validation-bypass
• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-p3hw-mv63-rf9w

Published

Aug 28, 2026

Last Modified

Aug 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82248gix-worktree-state before 0.33.0 (part of gitoxide) allows w…5.3
• CVE-2026-82249gitoxide before 0.38.2 fails to validate carriage return cha…3.1
• CVE-2026-8225A vulnerability was identified in Open5GS up to 2.7.7. This …7.5
• CVE-2026-82250gitoxide gix-packetline versions before 0.21.5 contain a pan…6.5
• CVE-2026-82251gitoxide before 0.52.1 fails to validate submodule names fro…7.5
• CVE-2026-82252gitoxide before 0.52.1 follows symlinks when reading the wor…7.5
• CVE-2026-82254gitoxide before 0.69.0 contains unchecked array indexing in …7.5
• CVE-2026-82255gitoxide versions from 0.25.4 contain an HTTP credential lea…6.8
• CVE-2026-82256SvelteKit before 2.69.1 fails to properly validate remote fo…5.3
• CVE-2026-82257SvelteKit versions before 2.69.1 contain a prototype polluti…4.3
• CVE-2026-82258SvelteKit versions from 2.38.0 before 2.60.1 contain a race …4.8
• CVE-2026-82259SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53…7.5