EUVD-2026-67701
GHSA-m78c-xpg9-p5ww
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via malicious URL but requires credential helper configuration and user-initiated git operation (UI:R, AC:H); only credentials exposed so C:L, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.
AnalysisAI
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: the target environment must use gitoxide (not standard git) as the Git client; a credential helper must be actively configured in the gitoxide or system Git configuration - environments with no credential helper are unexploitable; the attacker must be able to supply or influence a URL that gitoxide processes and forwards to the helper (e.g., via a malicious remote URL, submodule reference, or redirected fetch); and the user must initiate a gitoxide operation (clone, fetch, push) that triggers the credential lookup against the malicious URL (CVSS UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterises the constrained risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to gitoxide version 0.38.2 or later, which introduces validation that rejects bare carriage return characters in URL values before they are passed to credential helpers; this is the primary fix confirmed by the vendor advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6wr8-3w4h-j9wj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the gitoxide Rust library (gix-submodule crate before 0.82.0, gix before 0.83.0) allows attackers c
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during c
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repositor
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today