CVE-2026-82253: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitoxideLabs gitoxide

The vulnerability in gitoxide's Rust crates gix (<=0.72.0) and gix-validate (<=0.10.0) involves improper limitation of a pathname to a restricted directory (path traversal). The submodule name validation function only checks the first occurrence of '..', allowing crafted submodule names like 'a..b/../../../.git/' to bypass validation. Additionally, this validation is not used in production code paths. A trust inheritance flaw in Submodule::open() clones the parent repository's git_dir_trust (Trust::Full) without ownership verification, enabling an attacker to craft a malicious .gitmodules file. This causes victim tools built on gitoxide to read arbitrary git repository configurations, including embedded credentials, with full trust, effectively bypassing safe-directory protections. The vulnerability is addressed in gix 0.82.0 and gix-validate 0.11.1.

An attacker can exploit the path traversal and trust inheritance flaws to cause victim tools using vulnerable gitoxide versions to read arbitrary git repository configuration files with full trust. This includes potentially sensitive data such as embedded credentials. The bypass of safe-directory protections increases the risk of unauthorized access to repository configurations, which could lead to further compromise or data leakage.

This vulnerability is fixed in gix version 0.82.0 and gix-validate version 0.11.1. Users should upgrade to these versions or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.