CVE-2026-82251

Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.52.1

Description Insufficient validation of submodule names within the .gitmodules configuration allows for path traversal when deriving submodule git directories. An attacker can use malicious submodule names containing traversal segments to redirect the state() and open() functions to repositories located outside the .git/modules directory. This leads to repository confusion and allows the inspection of repositories controlled by the attacker.

Recommendations Update gitoxide to version 0.52.1 or later.