EUVD-2026-67704
GHSA-wj8r-8wwg-mq4f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Victim must clone or open the attacker-supplied repository (UI:R); impact is read-only confidentiality with no integrity or availability effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.
AnalysisAI
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious repository to exfiltrate arbitrary files outside the repository boundary through submodule metadata. When Repository::submodules() processes a worktree .gitmodules that is a symlink, std::fs::read() transparently follows it to an attacker-chosen target, and the resulting bytes are parsed as submodule configuration, exposing attacker-controlled name, path, and url values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is running gitoxide 0.52.0 or earlier (or gix below 0.83.0) and that code calls Repository::submodules() on a repository where the worktree .gitmodules is a symlink pointing outside the repository tree. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) captures the high confidentiality impact and low-complexity attack path, but the UI:N designation warrants scrutiny: in practice the victim must clone or otherwise open the malicious repository, implying at least passive user interaction that the provided vector does not model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade gitoxide to version 0.52.1 or later and the gix crate to version 0.83.0 or later, as confirmed by the vendor advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pg4w-g64p-qwhj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems for gitoxide and gix usage, documenting all current versions deployed in production and CI/CD infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the gitoxide Rust library (gix-submodule crate before 0.82.0, gix before 0.83.0) allows attackers c
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repositor
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during c
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena
Control-character injection in gitoxide's gix-transport crate before version 0.59.2 lets crafted git-daemon URLs smuggle
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today