Threats Tagged 'cve-2026-82253'

CVE-2026-82247 is a high-severity vulnerability in GitoxideLabs gitoxide affecting the gix-url and gix-transport crates. The vulnerability arises from improper handling of '?' and '#' characters in the URL parser of gix-url (versions up to 0.32.0) and incorrect host comparison in the HTTP redirect identity guard of gix-transport (versions up to 0.49.0). This flaw allows an attacker who controls an HTTP redirect response to craft a malicious Location header that causes gitoxide to send HTTP Basic Authorization credentials to an unintended host.

gitoxide versions gix up to 0.72.0 and gix-validate up to 0.10.0 contain a path traversal vulnerability in submodule name validation. The validation only checks the first occurrence of '..' and is not invoked in production, allowing crafted names to bypass checks. Combined with a trust inheritance flaw in Submodule::open(), an attacker can craft malicious .gitmodules files to read arbitrary git repository configuration with full trust, bypassing safe-directory protections. The issue is fixed in gix 0.82.0 and gix-validate 0.11.1.