CVE-2026-82249: Improper Encoding or Escaping of Output in GitoxideLabs gitoxide

CVE-2026-82249 describes a vulnerability in gitoxide prior to version 0.38.2 where carriage return characters in URLs passed to credential helpers are not properly validated. This improper encoding or escaping of output enables attackers to inject extra helper protocol fields. As a result, credential helpers may return credentials for attacker-controlled hosts rather than the legitimate requested URL, potentially leading to credential disclosure. The CVSS 4.0 base score is 2.3, indicating low severity. No official remediation level or patch information is provided in the available data.

The impact is limited to potential credential disclosure due to manipulated URL inputs causing credential helpers to return credentials for attacker-specified hosts. The low CVSS score reflects that exploitation requires user interaction and has high attack complexity. There are no known exploits in the wild, and no indication of privilege escalation or system compromise beyond credential exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling URLs passed to credential helpers and avoid using untrusted URLs. Monitor vendor channels for updates regarding patches or official mitigations.