Path Traversal and Trust Inheritance Vulnerability in gitoxide

The gitoxide project (gix and gix-validate crates) contains a path traversal vulnerability that, when combined with an insecure trust inheritance flaw in Submodule::open(), allows an attacker to compromise repositories using these libraries. The validation function in gix-validate only checks for the first occurrence of '..' in submodule names, which can be bypassed using crafted strings such as 'a..b/../../../.git/'. Furthermore, this validation is not invoked in active code paths. The vulnerability is amplified by a trust inheritance flaw in Submodule::open(), where parent repository trust levels (Trust::Full) are incorrectly propagated to submodules, bypassing ownership verification and safe-directory protections. An attacker can craft a malicious .gitmodules file to force applications using gitoxide to read arbitrary repository configurations, potentially exposing embedded credentials or executing actions with unintended privileges. The vulnerability was addressed in gix version 0.82.0 and gix-validate version 0.11.1.

Impact

Successful exploitation allows for the reading of sensitive git repository configurations, including embedded credentials, potentially impacting any software built on the affected versions of the gitoxide ecosystem. It bypasses established safe-directory security mechanisms, increasing the risk of unauthorized repository access or data exfiltration in development environments or CI/CD pipelines.

Recommendation

Update all projects using the gitoxide library to the patched versions immediately. Developers should audit usage of Submodule::open() and ensure that inputs from external .gitmodules files are sanitized before processing.

• Upgrade the gix crate to version 0.82.0 or later.
• Upgrade the gix-validate crate to version 0.11.1 or later.
• Audit repositories for unusually formatted entries in .gitmodules files, specifically those containing directory traversal sequences.