CVE-2026-82252: gitoxide Path Traversal Vulnerability

CVE-2026-82252 Overview

CVE-2026-82252 affects gitoxide, a pure-Rust implementation of Git, in versions prior to 0.52.1. The library follows symbolic links when reading the worktree .gitmodules file. A malicious repository can ship a .gitmodules symlink that points outside the repository tree. When gitoxide parses this file, it treats arbitrary external file content as submodule configuration. Attackers control the resulting submodule name, path, and url values. The flaw is tracked as a link-following weakness [CWE-59].

Critical Impact
A crafted repository can inject out-of-repository bytes into submodule metadata, exposing attacker-controlled configuration values to downstream tooling.

Affected Products

gitoxide versions before 0.52.1
Rust applications and CLIs that consume the gitoxide crates for submodule parsing
CI/CD pipelines and code hosting tools built on gitoxide

Discovery Timeline

2026-08-28 - CVE-2026-82252 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-82252

Vulnerability Analysis

The .gitmodules file defines submodule metadata inside a Git repository. Git and compatible implementations expect this file to be a regular file located at the repository root. gitoxide before 0.52.1 opens .gitmodules in the worktree without checking whether the path resolves to a symbolic link. When a repository ships a .gitmodules symlink, gitoxide follows it and parses whatever file the link targets. That file may reside outside the repository boundary. The parser then exposes the extracted name, path, and url fields to callers as if they were legitimate submodule declarations.

Root Cause

The root cause is a missing symlink check on the worktree .gitmodules path. gitoxide trusts the resolved path instead of enforcing that the file is a regular file contained within the repository. This is a classic link-following defect classified under [CWE-59]. The repository boundary invariant that Git enforces is not honored by the gitoxide worktree code path.

Attack Vector

An attacker publishes a repository containing a symlinked .gitmodules entry that points to a target file on the victim host, such as a system configuration or a file at a predictable absolute path. When a user or automated pipeline clones or scans the repository with gitoxide, the library reads the linked file and parses it as submodule configuration. The attacker influences downstream logic that acts on name, path, and url values. This may drive tooling to fetch attacker-controlled URLs, write files to attacker-chosen paths, or leak host file contents into logs and error output.

Exploitation code is not required beyond crafting the malicious repository. See the GitHub Security Advisory GHSA-pg4w-g64p-qwhj and the VulnCheck Advisory for Gitoxide for technical details.

Detection Methods for CVE-2026-82252

Indicators of Compromise

Repositories where .gitmodules at the worktree root is a symbolic link rather than a regular file.
Submodule entries whose path or url values reference absolute host paths, file:// URIs, or paths outside the repository tree.
Unexpected file reads on gitoxide-based hosts targeting sensitive locations such as /etc/, user home directories, or CI secret mounts.

Detection Strategies

Scan repositories in registries and mirrors for a .gitmodules entry whose file mode indicates a symlink.
Add pre-clone or pre-fetch checks in CI that reject trees containing a symlinked .gitmodules.
Diff the resolved .gitmodules content against the raw blob in the tree object to detect out-of-tree substitution.

Monitoring Recommendations

Log all invocations of gitoxide-based tools with the repository URL, commit hash, and library version.
Alert on gitoxide processes reading files outside the working directory of the repository being processed.
Track dependency inventories for the gitoxide crate version across build agents and developer workstations.

How to Mitigate CVE-2026-82252

Immediate Actions Required

Upgrade all applications and CI images that embed gitoxide to version 0.52.1 or later.
Inventory Rust dependencies with cargo tree to locate transitive uses of gitoxide crates and rebuild affected artifacts.
Treat any repository processed by a vulnerable gitoxide version as untrusted and review submodule metadata before acting on it.

Patch Information

The fix is available in gitoxide0.52.1. Consult the GitHub Security Advisory GHSA-pg4w-g64p-qwhj for affected crate versions and the corresponding fixed releases. Update Cargo.toml constraints and regenerate Cargo.lock to pull the patched versions across the dependency graph.

Workarounds

Reject repositories where .gitmodules is a symbolic link before invoking gitoxide.
Run gitoxide-based tooling under a restricted filesystem sandbox that blocks reads outside the repository directory.
Disable submodule processing in vulnerable tooling paths until the upgrade to 0.52.1 is complete.

bash

# Configuration example
# Enforce patched gitoxide across the dependency graph
cargo update -p gix
cargo tree -i gix | grep -v '0.52.1' && echo 'Vulnerable gitoxide versions still present'

# Pre-clone guard: refuse trees with a symlinked .gitmodules
git ls-tree HEAD .gitmodules | awk '$2=="blob" && $1!~/^120000$/ {ok=1} END {exit ok?0:1}'