CVE-2026-82252 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
Attackers can inject malicious submodule metadata by symlinking .gitmodules, potentially leading to arbitrary file reads or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82252?
CVE-2026-82252 is a high-severity path traversal vulnerability in GitoxideLabs gitoxide, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.
Weakness: CWE-59
Which versions are affected by CVE-2026-82252?
4 open source packages ship an affected version, including gitoxide and gix.
| Package | Affected | Fixed in |
|---|---|---|
gitoxide crates.io | All versions | 0.52.1 |
gitoxide crates.io | All versions | 0.52.1 |
gix crates.io | All versions | 0.83.0 |
gix crates.io | All versions | 0.83.0 |
How do I fix CVE-2026-82252?
Upgrade gitoxide to 0.52.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82252 exists.
Sources
Also known as AZL-98415, AZL-98427, DEBIAN-CVE-2026-82252, GHSA-pg4w-g64p-qwhj, GHSA-wj8r-8wwg-mq4f, MINI-p547-w83f-gw49 and 1 more.