SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-82253

HIGH · CVSS 7.5 EPSS 0.50% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-28 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability affects the gitoxide libraries gix and gix-validate, allowing attackers to exploit a path traversal flaw to craft malicious submodule names that can bypass validation checks. This can lead to unauthorized access to arbitrary git repository configurations, including sensitive credentials, due to trust inheritance issues in the Submodule::open() function. Organizations using these libraries, particularly those handling sensitive data or credentials, should prioritize updating to gix 0.82.0 and gix-validate 0.11.1 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-82253
Severity
HIGH
CVSS
7.5
EPSS
0.50%

Original NVD Description

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.