EUVD-2026-67699
GHSA-c828-8g79-fpj5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or special conditions beyond attacker-controlled redirect; impact is purely credential confidentiality with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).
AnalysisAI
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal the caller's HTTP Basic Authorization credentials by exploiting a hand-rolled URL parser in gix-url that misidentifies the authority component of crafted redirect URLs. Affected are gix-url versions ≤ 0.32.0 and gix-transport versions ≤ 0.49.0; the redirect identity guard can_reuse_identity fails open when the parser does not treat '?' or '#' as authority terminators per RFC 3986, causing credentials to be forwarded to an unintended host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the client use gitoxide (gix-transport ≤ 0.49.0 and gix-url ≤ 0.32.0) to perform HTTP or HTTPS-based git operations where credentials are configured as HTTP Basic Authorization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects a theoretically high-severity credential theft path with no authentication or precondition requirements. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade gix-url to version 0.37.1 or later and gix-transport to version 0.58.1 or later, as described in the vendor advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-jrcm-326h-gpp8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using gitoxide gix-url versions ≤0.32.0 and gix-transport versions ≤0.49.0 across development, CI/CD, and automation infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the gitoxide Rust library (gix-submodule crate before 0.82.0, gix before 0.83.0) allows attackers c
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during c
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repositor
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today