https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 05:34:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-82253 <p><strong>Affected:</strong> GitoxideLabs gitoxide</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> <p><strong>Affected:</strong> GitoxideLabs gitoxide</p> <p>gitoxide (Rust crates gix &lt;= 0.72.0 and gix-validate &lt;= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of &#39;..&#39; via name.find(b&#34;..&#34;), allowing crafted names such as &#39;a..b/../../../.git/&#39; to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository&#39;s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.</p> https://vulnerability.circl.lu/vuln/cve-2026-82253