EUVD-2026-67703
GHSA-66gr-hvvc-vvxc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious repository triggers traversal with no privileges or interaction; impact is confidentiality-only with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.
AnalysisAI
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repository to redirect submodule git directory resolution outside .git/modules, exposing arbitrary on-disk repository structure to inspection. The flaw stems from submodule names read from .gitmodules being joined directly as filesystem path components with no normalization or confinement check, so a name such as '../../../escaped-target.git' escapes the expected directory boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses the gitoxide crate (before 0.52.1) or gix crate (before 0.83.0) and invokes the state() or open() functions on submodules sourced from an attacker-supplied .gitmodules file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) reflects a high-confidence confidentiality impact with no integrity or availability consequence, which aligns well with the described behaviour: an attacker gains the ability to inspect repositories outside .git/modules but cannot write data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the gitoxide crate to version 0.52.1 or later and the gix crate to version 0.83.0 or later, as confirmed by vendor advisory GHSA-fr8x-3vfx-f45h (https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running gitoxide or gix across your development infrastructure and CI/CD platforms, and immediately restrict git clone/pull operations to repositories from trusted internal sources only-block public repository consumption during this critical window. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the gitoxide Rust library (gix-submodule crate before 0.82.0, gix before 0.83.0) allows attackers c
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during c
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today