Path Traversal Vulnerability in gitoxide

Gitoxide, a pure Rust implementation of Git, is vulnerable to a path traversal issue (CVE-2026-82252) affecting versions before 0.52.1. The flaw resides in how the tool processes the '.gitmodules' file within a worktree. When parsing this file, gitoxide fails to validate that the file location remains within the confines of the repository, allowing it to follow symbolic links. An attacker can create a malicious repository containing a '.gitmodules' file that is actually a symlink to sensitive files elsewhere on the host system. When a victim uses an affected version of gitoxide to interact with this repository, the tool parses the target file, potentially exposing sensitive data or injecting attacker-controlled values into the submodule metadata (path, name, and URL). This could lead to further exploitation, such as the execution of malicious code during subsequent submodule update operations.

Impact

Successful exploitation allows an attacker to influence the configuration of Git submodules by injecting contents from arbitrary files on the victim's filesystem. This behavior could be leveraged to redirect submodule fetches to malicious servers or facilitate command execution depending on how the parsed metadata is consumed by the victim's environment. The vulnerability impacts any developer or automated build system utilizing versions of gitoxide below 0.52.1 to process untrusted repositories.

Recommendation

• Upgrade the gitoxide library to version 0.52.1 or higher across all development environments, CI/CD pipelines, and server-side infrastructure.
• Audit repositories processed by affected versions of gitoxide for unexpected symbolic links within the worktree, specifically targeting the '.gitmodules' file.
• Deploy environment-level restrictions to prevent user-space tools from traversing outside of known project directories if the environment regularly interacts with untrusted git repositories.