CVE-2026-82253: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-82253 is a path traversal and credential disclosure vulnerability in gitoxide, the Rust-based Git implementation maintained by GitoxideLabs. It affects the gix crate (versions ≤ 0.72.0) and gix-validate crate (versions ≤ 0.10.0). The vulnerability was published on August 28, 2026, with the security advisory originally filed on April 25, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, GitoxideLabs Advisory).

The vulnerability stems from two compounding flaws classified under CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information). First, the name() validation function in gix-validate/src/submodule.rs uses name.find(b"..") which only checks the first occurrence of .. — a crafted name like a..b/../../../.git/ passes validation because the initial .. in a..b is not followed by a slash, causing the function to return Ok without inspecting the subsequent /../../../ traversal sequences. Second, this validation function is never called in production code paths; git_dir() in gix/src/submodule/mod.rs constructs filesystem paths directly from raw, unvalidated submodule names. A third flaw in Submodule::open() compounds the issue: it clones the parent repository's options including git_dir_trust = Trust::Full, and since trust is already Some(Full), the ownership verification check at gix/src/open/repository.rs is skipped entirely, bypassing gitoxide's safe-directory protections (GitoxideLabs Advisory).

Successful exploitation allows an unauthenticated attacker to cause a victim tool built on gitoxide to open arbitrary git directories as submodule repositories with full trust, exposing their configuration files. Sensitive data at risk includes embedded credentials such as remote.origin.url tokens (e.g., https://user:token@github.com/...), http.extraHeader values (often Authorization: Bearer tokens), credential.* sections, and core.sshCommand entries. There is no integrity or availability impact — the vulnerability is purely a confidentiality issue — but credential theft could enable lateral movement to other systems or repositories (GitoxideLabs Advisory, GitHub Advisory).

The NVD SSVC assessment classifies this vulnerability as having a proof-of-concept (PoC) available and as automatable, though no public PoC repository has been identified and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.497% (41st percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The attack requires no authentication and no privileges, but does require user interaction in the form of a victim performing submodule operations (e.g., open() or status()) on a maliciously crafted repository. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious repository: Create a git repository containing a .gitmodules file with a crafted submodule name designed to bypass validation, such as:

[submodule "x..y/../../.."]
    path = innocent
    url = https://attacker.com/repo.git

2. Host the repository: Make the malicious repository available via a public or targeted hosting platform (e.g., GitHub, self-hosted git server) accessible to the victim.
3. Induce victim to clone: Social-engineer or otherwise cause the victim to clone the malicious repository using a tool built on gitoxide (e.g., a CI/CD pipeline, IDE plugin, or custom tooling using the gix crate).
4. Trigger submodule operations: Wait for or induce the victim's tool to call submodule.open() or submodule.status() on the repository's submodules. Tools that only list submodules without opening them are not affected.
5. Path traversal occurs: git_dir() constructs the path .git/modules/x..y/../../.. from the unvalidated submodule name, which resolves to the parent .git/ directory.
6. Trust bypass: open_opts() is called with Trust::Full inherited from the parent repository, skipping ownership verification and bypassing safe-directory protections.
7. Credential extraction: The attacker's controlled repository or tool receives or logs the exposed configuration values (e.g., remote.origin.url with embedded tokens, http.extraHeader with Bearer tokens) accessible via standard gitoxide API calls such as repo.config_snapshot().string("http.extraHeader") (GitoxideLabs Advisory).

• File System: Presence of a .gitmodules file containing submodule names with embedded .. sequences not immediately followed by / (e.g., a..b/, x..y/) combined with subsequent ../ traversal sequences; submodule path values that do not correspond to the submodule name.
• Logs: Git or application logs showing submodule operations (open, status) on repositories cloned from untrusted or unexpected sources; errors or unexpected behavior when processing submodule configuration.
• Network: Outbound connections to unexpected remote URLs listed in .gitmodules files, particularly where the submodule URL differs significantly from the parent repository's hosting domain; connections to attacker-controlled infrastructure following a repository clone operation.
• Process: Unexpected access to .git/config files outside the expected repository directory tree by gitoxide-based tooling; processes reading git configuration files from paths that include modules/ followed by directory traversal sequences.

Upgrade gix to version 0.82.0 or later and gix-validate to version 0.11.1 or later, which fix all three underlying flaws: the incomplete .. check, the missing validation call in production code paths, and the trust inheritance bypass in Submodule::open() (GitoxideLabs Advisory, GitHub Advisory). As a workaround prior to patching, avoid cloning or processing repositories from untrusted sources using gitoxide-based tools, and disable or avoid submodule operations (open(), status()) on untrusted repositories. Additionally, audit any git configuration files and credentials (particularly embedded tokens in remote URLs or http.extraHeader values) that may have been exposed through tools using vulnerable versions.

The vulnerability was discussed on Mastodon shortly after disclosure, with posts from security-focused accounts including @thehackerwire and researcher @hugovalters noting the credential disclosure risk (Mastodon - thehackerwire, Mastodon - hugovalters). The advisory credits researcher kodareef5 as the reporter. Microsoft also published a reference entry for this CVE, suggesting awareness across the broader ecosystem given gitoxide's use in developer tooling (Microsoft MSRC).