CVE-2026-82249 Overview
CVE-2026-82249 is an output encoding vulnerability [CWE-116] in gitoxide, a pure Rust implementation of Git. Versions before 0.38.2 fail to validate carriage return (\r) characters in URL values passed to credential helpers. Attackers can craft URLs containing bare carriage returns to inject additional helper protocol fields. This causes credential helpers to return credentials for an attacker-specified host rather than the URL originally requested by the user.
Critical Impact
Credential helpers may release credentials for hosts other than the one the user intended to contact, enabling credential theft through malicious repository URLs.
Affected Products
- gitoxide versions prior to 0.38.2
- Rust applications and tools that embed gitoxide crates for Git operations
- Downstream consumers invoking credential helpers through gitoxide
Discovery Timeline
- 2026-08-28 - CVE-2026-82249 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-82249
Vulnerability Analysis
The flaw resides in how gitoxide serializes URL values when communicating with external credential helpers. The Git credential helper protocol is a line-oriented, key-value format where each field is terminated by a newline. Fields such as protocol, host, path, and url are written on separate lines and consumed by helpers to determine which credentials to return.
gitoxide sanitizes newline (\n) characters in URL components but does not reject or escape bare carriage returns (\r). Many credential helpers and parsers treat \r as a line terminator or strip it during processing. An attacker who supplies a repository URL containing \r sequences can smuggle additional protocol fields into the helper input stream.
Root Cause
The underlying weakness is improper output encoding for a downstream component [CWE-116]. gitoxide trusts URL content when writing to the credential helper channel and enforces only partial control-character filtering. Because the credential helper protocol lacks a structured framing layer, any control character interpreted as a line break by the helper allows field injection.
Attack Vector
Exploitation requires user interaction, such as cloning or fetching from an attacker-controlled URL, and depends on a helper that treats \r as a delimiter. The attacker crafts a URL where the host or path segment embeds a carriage return followed by attacker-chosen host= or protocol= fields. When gitoxide invokes the credential helper, the helper parses the injected fields and returns stored credentials for the attacker's target host. Those credentials are then transmitted to the original attacker-controlled endpoint.
The vulnerability manifests in the credential helper serialization path. Refer to the GitHub Security Advisory GHSA-6wr8-3w4h-j9wj and the VulnCheck Advisory on Gitoxide for the detailed technical writeup.
Detection Methods for CVE-2026-82249
Indicators of Compromise
- Repository URLs, submodule entries, or configuration values containing bare \r (0x0D) characters in host, path, or query components.
- Credential helper invocations where the resolved host value differs from the host present in the user-supplied URL.
- Outbound authentication requests to unexpected hosts immediately following clone or fetch operations against untrusted remotes.
Detection Strategies
- Inspect gitoxide-based tooling and dependency manifests (Cargo.toml, Cargo.lock) for gix, gitoxide, or related crate versions earlier than 0.38.2.
- Log and review credential helper stdin traffic for control characters, particularly \r occurring inside URL fields.
- Perform static review of any code paths that pass user-controlled URLs into gitoxide APIs invoking credential helpers.
Monitoring Recommendations
- Monitor developer workstations and CI runners for Git operations against unrecognized or newly registered domains.
- Alert on credential helper processes that emit credentials for hosts not present in recent shell history or CI job definitions.
- Track software composition analysis output for continued use of vulnerable gitoxide releases.
How to Mitigate CVE-2026-82249
Immediate Actions Required
- Upgrade all gitoxide crates and applications embedding gitoxide to version 0.38.2 or later.
- Rebuild and redeploy Rust binaries that statically link the affected gix crates.
- Audit stored Git credentials for signs of unauthorized use and rotate credentials that may have been exposed to untrusted remotes.
Patch Information
The issue is fixed in gitoxide 0.38.2. The patch adds validation that rejects URL values containing carriage return characters before they are passed to credential helpers. See the GitHub Security Advisory GHSA-6wr8-3w4h-j9wj for release details and affected crate mapping.
Workarounds
- Avoid cloning or fetching from untrusted or user-supplied URLs until the upgrade is deployed.
- Validate and sanitize URLs at the application layer, rejecting inputs that contain \r, \n, or other control characters before invoking gitoxide.
- Where possible, disable or restrict credential helpers on systems that process untrusted repository URLs, such as build agents handling third-party code.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
