CVE-2026-123532

Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.24.1

Description A credential disclosure issue exists in the gix-fs component. Remote attackers can capture NTLM credentials by providing UNC symlink targets within a crafted repository. On Windows systems with symlinks enabled, the gix fs::symlink::create() function calls is dir() on the UNC target, which triggers SMB authentication and leaks the username, domain, and NTLMv2 hash.

Recommendations Update gitoxide to version 0.24.1 or later.