CVE-2026-82253

CVE-2026-82253 is a path traversal flaw (CWE-22) in the Rust git implementation gitoxide: the submodule name validator in gix-validate only checks the first occurrence of '..' via name.find(b".."), so crafted names such as 'a..b/../../../.git/' bypass the check, and the validation is additionally never invoked in production code paths. When a tool built on gix opens a repository containing a malicious .gitmodules file, Submodule::open() inherits the parent repository's full trust (Trust::Full) while skipping ownership verification, causing attacker-controlled paths to be opened as fully trusted. The attacker gains the ability to have the victim tool read arbitrary git repository configuration, including embedded credentials, bypassing safe-directory protections; the 8.7 (High) CVSS 4.0 score reflects high confidentiality impact only. Affected parties are developers and automated tooling that embed gix <= 0.72.0 or gix-validate <= 0.10.0 and use them to inspect untrusted or attacker-supplied repositories. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation; EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade to gix 0.82.0 or later and gix-validate 0.11.1 or later, and check your Rust dependency tree (e.g., cargo tree or cargo audit) for any tools embedding the vulnerable ranges. Until patched, avoid using gix-based tools to open untrusted repositories or submodules, and assume that git configuration read from submodule paths may expose stored credentials because safe-directory trust is inherited without ownership verification.