CVE-2026-91986: gitoxide gix-transport XSS Vulnerability

CVE-2026-91986 Overview

CVE-2026-91986 is a control character injection vulnerability in the gix-transport crate of the gitoxide project, a pure-Rust implementation of Git. Versions before 0.59.2 fail to filter NUL, CR, and LF bytes when constructing git-daemon connect requests. Attackers can supply a crafted Git URL that injects additional NUL-delimited protocol fields or newline characters into the outbound daemon request stream. The injection allows spoofing of virtual host values (host=) and pollution of daemon-side logs. The flaw is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Attackers who control a Git URL passed to a gix-transport client can spoof virtual host identities on remote git-daemon servers and inject arbitrary content into request logs.

Affected Products

gitoxide gix-transport crate versions prior to 0.59.2
Rust applications and tooling that embed gix-transport for git:// protocol communication
Downstream gitoxide-based Git clients that expose URL parsing to untrusted input

Discovery Timeline

2026-09-15 - CVE-2026-91986 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91986

Vulnerability Analysis

The gix-transport crate builds git-daemon connect requests by concatenating user-supplied URL components into the wire-format packet. The Git daemon protocol uses NUL bytes as field separators inside a single pkt-line, most notably to append a host=<virtual host> field after the requested repository path. Because gix-transport did not reject or escape control characters in the parsed URL, an attacker controlling the URL could embed raw \\x00, \r, or \n bytes into the outbound request.

Exploitation requires user interaction, such as convincing a developer or automated pipeline to clone a malicious URL. The result is a low-impact confidentiality and integrity issue on the client-side request stream and the receiving daemon's log output.

Root Cause

The root cause is missing input sanitization on URL fields prior to their placement in a length-prefixed pkt-line. The transport layer trusted the parsed host and path strings without validating that they contained no protocol-reserved bytes. Fix version 0.59.2 filters control characters before assembling the connect request.

Attack Vector

An attacker crafts a Git URL where the host or path segment contains embedded NUL, CR, or LF bytes. When a victim uses a gitoxide-based tool to connect to that URL over the git:// protocol, the malicious bytes are written verbatim into the daemon connect request. Injected NUL bytes create additional protocol fields, letting the attacker present a spoofed host= value to the server and route the request to a virtual host the user did not intend. Injected CR/LF bytes break log formatting on daemons that record incoming requests.

Refer to the GitHub Security Advisory GHSA-rc7h-wp5f-w3g5 and the VulnCheck Advisory for protocol-level details.

Detection Methods for CVE-2026-91986

Indicators of Compromise

Outbound git:// connections where the pkt-line payload contains more than one NUL byte between the command and the terminating NUL.
git-daemon log entries containing embedded CR/LF sequences or unexpected extra fields such as duplicate host= values.
Git URLs in build scripts, CI configurations, or dependency manifests containing percent-encoded %00, %0d, or %0a in the host or path.

Detection Strategies

Inventory Rust binaries and services that depend on gix-transport and compare their resolved crate version against 0.59.2.
Inspect Cargo.lock files across repositories for gix-transport entries below the fixed version.
Enable protocol-level logging on git-daemon servers and alert on requests whose decoded pkt-line contains more than the expected two NUL-delimited fields.

Monitoring Recommendations

Monitor CI/CD systems for clone operations against untrusted or user-controlled Git URLs.
Log and review the raw request line received by internal git-daemon instances for control character anomalies.
Track new releases of gitoxide crates in dependency scanners to catch regressions quickly.

How to Mitigate CVE-2026-91986

Immediate Actions Required

Upgrade the gix-transport crate to version 0.59.2 or later in all Rust projects and rebuild affected binaries.
Audit applications that accept Git URLs from external input and reject URLs containing control characters before passing them to any Git client library.
Restrict use of the unauthenticated git:// protocol in favor of https:// or ssh:// where feasible.

Patch Information

The vulnerability is fixed in gix-transport0.59.2. Update the dependency in Cargo.toml, run cargo update -p gix-transport, and verify the resolved version in Cargo.lock. Consumers using higher-level gitoxide crates should update to a gitoxide release that pulls in the patched transport crate. See the GitHub Security Advisory GHSA-rc7h-wp5f-w3g5 for the fix commit reference.

Workarounds

Validate and reject any Git URL containing \\x00, \r, or \n (including percent-encoded forms) before invoking gix-transport.
Disable the git:// protocol in client configurations and route all Git traffic through authenticated HTTPS or SSH transports.
Isolate git-daemon servers behind reverse proxies that sanitize inbound request framing.

bash

# Update gix-transport to the patched release
cargo update -p gix-transport --precise 0.59.2
cargo tree -i gix-transport | grep -v '0.59.2' && echo 'Vulnerable versions still present'