{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/gitoxide/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-82253"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gix (\u003c= 0.72.0)","gix-validate (\u003c= 0.10.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","supply-chain","gitoxide","rust"],"_cs_type":"advisory","_cs_vendors":["gitoxide"],"content_html":"\u003cp\u003eThe gitoxide project (gix and gix-validate crates) contains a path traversal vulnerability that, when combined with an insecure trust inheritance flaw in Submodule::open(), allows an attacker to compromise repositories using these libraries. The validation function in gix-validate only checks for the first occurrence of '..' in submodule names, which can be bypassed using crafted strings such as 'a..b/../../../.git/'. Furthermore, this validation is not invoked in active code paths. The vulnerability is amplified by a trust inheritance flaw in Submodule::open(), where parent repository trust levels (Trust::Full) are incorrectly propagated to submodules, bypassing ownership verification and safe-directory protections. An attacker can craft a malicious .gitmodules file to force applications using gitoxide to read arbitrary repository configurations, potentially exposing embedded credentials or executing actions with unintended privileges. The vulnerability was addressed in gix version 0.82.0 and gix-validate version 0.11.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the reading of sensitive git repository configurations, including embedded credentials, potentially impacting any software built on the affected versions of the gitoxide ecosystem. It bypasses established safe-directory security mechanisms, increasing the risk of unauthorized repository access or data exfiltration in development environments or CI/CD pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate all projects using the gitoxide library to the patched versions immediately. Developers should audit usage of Submodule::open() and ensure that inputs from external .gitmodules files are sanitized before processing.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the gix crate to version 0.82.0 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade the gix-validate crate to version 0.11.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit repositories for unusually formatted entries in .gitmodules files, specifically those containing directory traversal sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-28T15:13:34Z","date_published":"2026-08-28T15:13:34Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-path-traversal/","summary":"A path traversal and trust inheritance vulnerability in the gitoxide Rust crates allows attackers to access arbitrary git configurations by crafting malicious .gitmodules files.","title":"Path Traversal and Trust Inheritance Vulnerability in gitoxide","url":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-path-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitoxide:gix-url:*:*:*:*:*:*:*:*","cpe:2.3:a:gitoxide:gix-transport:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-82247"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gix-url (\u003c= 0.32.0)","gix-transport (\u003c= 0.49.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["gitoxide"],"content_html":"\u003cp\u003eCVE-2026-82247 describes a security vulnerability in the gitoxide Rust crates gix-url (versions \u0026lt;= 0.32.0) and gix-transport (versions \u0026lt;= 0.49.0). The vulnerability stems from a custom URL parser in gix-url that fails to correctly interpret the '?' or '#' characters as terminators for the authority component of a URL, as defined in RFC 3986. This incorrect parsing allows the gix-transport HTTP redirect identity guard (can_reuse_identity) to misidentify the target host during an HTTP redirect.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by returning a malicious HTTP 3xx redirect with a crafted 'Location' header formatted as \u0026lt;attacker-authority\u0026gt;?@\u0026lt;original-authority\u0026gt;. The vulnerable identity guard incorrectly validates the target host, leading the client to reuse stored HTTP Basic Authorization credentials for the unintended attacker-controlled server. This flaw poses a high risk for any application leveraging gitoxide for Git operations that involve authenticating to remote repositories. Impacted users should update to gix-url 0.37.1 and gix-transport 0.58.1.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker hosts a malicious Git repository or HTTP server capable of serving custom HTTP 3xx redirect responses.\u003c/li\u003e\n\u003cli\u003eVictim initiates a Git operation (e.g., clone, fetch, or push) using a tool built with the vulnerable gitoxide crates.\u003c/li\u003e\n\u003cli\u003eVictim provides valid HTTP Basic Authorization credentials for the legitimate target repository.\u003c/li\u003e\n\u003cli\u003eAttacker returns an HTTP redirect response with a specially crafted 'Location' header: \u0026lt;attacker-authority\u0026gt;?@\u0026lt;original-authority\u0026gt;.\u003c/li\u003e\n\u003cli\u003eThe gix-url parser processes the 'Location' header but fails to terminate the authority component at the '?' character.\u003c/li\u003e\n\u003cli\u003eThe gix-transport identity guard compares the authority based on the flawed parsing and determines it is safe to reuse the existing credentials.\u003c/li\u003e\n\u003cli\u003eThe client library automatically includes the Authorization header containing the victim's credentials in the subsequent request to the attacker-controlled authority.\u003c/li\u003e\n\u003cli\u003eAttacker logs the Authorization header, successfully capturing the victim's plaintext credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized exposure of HTTP Basic Authorization credentials to an attacker. This potentially grants the attacker persistent access to the victim's private repositories or associated services, depending on the scope of the captured credentials. This affects any downstream software in the Rust ecosystem that integrates the gitoxide library for repository interaction.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all applications and internal tooling within the organization that utilize the gitoxide Rust crates by auditing Cargo.lock files for gix-url and gix-transport.\u003c/li\u003e\n\u003cli\u003eUpdate gix-url to version 0.37.1 or higher and gix-transport to version 0.58.1 or higher to incorporate the corrected URL parsing logic.\u003c/li\u003e\n\u003cli\u003eFor applications where immediate patching is not possible, implement strict allowlists for trusted host destinations to prevent redirects to unauthorized domains.\u003c/li\u003e\n\u003cli\u003ePerform log analysis on outbound HTTP requests from build servers and automated tooling to identify suspicious redirect responses involving unconventional URL formatting.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T15:13:19Z","date_published":"2026-08-28T15:13:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-url-parsing/","summary":"An improper URL parsing flaw in the gitoxide gix-url crate enables credential theft by causing the gix-transport identity guard to transmit HTTP Basic Authorization headers to unauthorized hosts via crafted redirects.","title":"Credential Disclosure Vulnerability in gitoxide gix-url and gix-transport Crates","url":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-url-parsing/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-82252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gitoxide (\u003c 0.52.1)","gitoxide"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gitoxide"],"content_html":"\u003cp\u003eGitoxide, a pure Rust implementation of Git, is vulnerable to a path traversal issue (CVE-2026-82252) affecting versions before 0.52.1. The flaw resides in how the tool processes the '.gitmodules' file within a worktree. When parsing this file, gitoxide fails to validate that the file location remains within the confines of the repository, allowing it to follow symbolic links. An attacker can create a malicious repository containing a '.gitmodules' file that is actually a symlink to sensitive files elsewhere on the host system. When a victim uses an affected version of gitoxide to interact with this repository, the tool parses the target file, potentially exposing sensitive data or injecting attacker-controlled values into the submodule metadata (path, name, and URL). This could lead to further exploitation, such as the execution of malicious code during subsequent submodule update operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to influence the configuration of Git submodules by injecting contents from arbitrary files on the victim's filesystem. This behavior could be leveraged to redirect submodule fetches to malicious servers or facilitate command execution depending on how the parsed metadata is consumed by the victim's environment. The vulnerability impacts any developer or automated build system utilizing versions of gitoxide below 0.52.1 to process untrusted repositories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the gitoxide library to version 0.52.1 or higher across all development environments, CI/CD pipelines, and server-side infrastructure.\u003c/li\u003e\n\u003cli\u003eAudit repositories processed by affected versions of gitoxide for unexpected symbolic links within the worktree, specifically targeting the '.gitmodules' file.\u003c/li\u003e\n\u003cli\u003eDeploy environment-level restrictions to prevent user-space tools from traversing outside of known project directories if the environment regularly interacts with untrusted git repositories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-28T15:13:28Z","date_published":"2026-08-28T13:14:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-symlink-vulnerability/","summary":"Gitoxide versions prior to 0.52.1 contain a path traversal vulnerability via symlink following that allows attackers to inject arbitrary file contents into submodule configuration metadata.","title":"Path Traversal Vulnerability in gitoxide","url":"https://feed.craftedsignal.io/briefs/2026-08-gitoxide-symlink-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Gitoxide","version":"https://jsonfeed.org/version/1.1"}