VULNERABILITY INTELLIGENCE
CVE-2026-82252
CVSS score7.5 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-08-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.
Weakness classification
- disclosure@vulncheck.com: CWE-59