https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:05:35 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82253 <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82253 https://vulnerability.circl.lu/vuln/ghsa-6f8q-f8px-cxhw <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> https://vulnerability.circl.lu/vuln/ghsa-6f8q-f8px-cxhw https://vulnerability.circl.lu/vuln/msrc_cve-2026-82253 msrc_CVE-2026-82253 https://vulnerability.circl.lu/vuln/msrc_cve-2026-82253 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11730-1 <p>cargo-audit-0.22.2~git0.281452c-3.1 on GA media</p> <p>cargo-audit-0.22.2~git0.281452c-3.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11730-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82253 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-gix-validate, Ubuntu:26.04:LTS: rust-gix, Ubuntu:26.04:LTS: rust-gix-validate</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-gix-validate, Ubuntu:26.04:LTS: rust-gix, Ubuntu:26.04:LTS: rust-gix-validate</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82253