gitoxide CVE-2026-82253

The victim must be running a tool built on the gix crate (< 0.83.0 per GHSA) that processes git repositories with submodule entries - specifically, code paths that call Submodule::open() or construct paths via git_dir() from submodule names. The attacker must supply a repository the victim's tool will process, either via a public clone URL or a crafted repository archive. No authentication is required on the attacker side (confirmed by PR:N in CVSS 4.0 vector). The traversal payload must resolve to a directory on the victim filesystem that contains a readable git config structure (e.g., ~/.ssh/ if it contains a .git/config, or more commonly the user's home git config). Limiting factors: only gitoxide-based tooling is affected - native git, libgit2-based tools, and JGit are unaffected; the traversal target must be a git repository directory structure (arbitrary file read is not achieved); and the victim system must have a .git/config or similar git config at the traversed path containing credentials of value to the attacker.

The CVSS 4.0 base score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects high real-world confidentiality impact: no authentication is required on the attacker side, attack complexity is low, and the confidentiality impact on the vulnerable system is high due to potential credential disclosure from git configs. The EPSS score was not provided in the source data. KEV status is negative - CISA has not listed this CVE, indicating no confirmed widespread exploitation at time of analysis. A PoC was referenced in the GHSA advisory (truncated in available data), which upgrades risk relative to a theoretical-only finding. The three-bug chain is significant: Bug 2 (validation never called) means Bug 1 alone is only a partial assessment - even a correct validator would have done nothing in production. This is an architectural flaw, not just an edge-case bypass. Real-world impact is bounded by the deployment footprint of gitoxide-based tooling, which is currently niche within the Rust ecosystem; tools like gitui, jj, and custom CI pipelines using gix are the primary at-risk surface. The UI:N CVSS 4.0 rating is defensible for automated pipeline contexts where submodule processing is triggered implicitly during clone operations.

An attacker publishes a public git repository containing a .gitmodules file with a crafted submodule name such as a..b/../../../home/user/.ssh/.git/; a developer or automated CI system running a gitoxide-based tool clones or processes this repository, causing git_dir() to construct a traversal path into ~/.ssh/ without triggering the defective validator. The trust inheritance flaw causes Submodule::open() to open that directory with Trust::Full, allowing the tool to read ~/.git/config or similar files from the traversed path and potentially log or exfiltrate any embedded credentials such as PATs or credential.helper stored tokens. A compiled PoC was referenced in the GHSA advisory (Rust 1.94.1 release mode), indicating this scenario is demonstrably achievable.