CVE-2026-82252: Improper Link Resolution Before File Access ('Link Following') in GitoxideLabs gitoxide

The vulnerability in gitoxide before 0.52.1 involves improper link resolution when accessing the .gitmodules file in the worktree. By following symbolic links, gitoxide can be tricked into reading files outside the repository directory. An attacker can exploit this by creating a repository with a symlinked .gitmodules file that points to an external file, causing gitoxide to parse and use attacker-controlled data as submodule metadata. This can result in injection of malicious submodule configuration parameters.

An attacker can inject arbitrary submodule metadata by causing gitoxide to parse external files as .gitmodules configuration. This may lead to unexpected behavior or manipulation of submodule references based on attacker-controlled data. The vulnerability has a CVSS 4.0 score of 8.7 (high severity), indicating it is remotely exploitable without privileges or user interaction and can cause high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 0.52.1, upgrading to version 0.52.1 or later is likely the intended fix once officially released. Until then, avoid using untrusted repositories or symlinked .gitmodules files. Monitor vendor communications for an official fix.