CVE-2026-82253

Name of the Vulnerable Software and Affected Versions gix versions prior to 0.82.0 gix-validate versions prior to 0.11.1

Description A path traversal issue exists due to improper validation of submodule names and a trust inheritance flaw. The name() function in gix-validate only checks the first occurrence of .., allowing crafted names like a..b/../../../.git/ to bypass the check. Furthermore, this validation is not invoked in production code paths. In Submodule::open(), the parent repository's git dir trust (set to Trust::Full) is cloned, which causes the system to skip ownership verification. An attacker can exploit this by crafting a malicious .gitmodules file, leading a tool built on gitoxide to read arbitrary git repository configurations, including embedded credentials, while bypassing safe-directory protections.

Recommendations Update gix to version 0.82.0 or later. Update gix-validate to version 0.11.1 or later. As a temporary mitigation, avoid performing submodule operations such as calling open() or status() on repositories from untrusted sources.