gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3181 advisory.

    gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout     mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced     checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink     entries replace validated directories, causing subsequent files to be written outside the worktree through     the symlink for code execution or file manipulation. (CVE-2026-100419)

    gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential     helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol     fields and cause credential helpers to return credentials for attacker-specified hosts instead of the     requested URL. (CVE-2026-82249)

    gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation     that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a     crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch     operations without authentication. (CVE-2026-82250)

    gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path     traversal when deriving submodule git directories. Attackers can craft malicious submodule names with     traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing     repository confusion and inspection of attacker-controlled repositories. (CVE-2026-82251)

    gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to     inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a     symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external     files as submodule configuration and expose attacker-controlled name, path, and url values.
    (CVE-2026-82252)

    gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability.
    The submodule name validation function in gix-validate only checks the first occurrence of '..' via     name.find(b..), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally     this validation is never invoked in production code paths. Combined with a trust inheritance flaw in     Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership     verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on     gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust,     bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. (CVE-2026-82253)

    gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from     attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch     operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)

    gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport     backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability     occurs because credential validation checks the original URL instead of the effective URL after redirect,     allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP     downgrades. (CVE-2026-82255)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to     inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a     symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external     files as submodule configuration and expose attacker-controlled name, path, and url values.
    (CVE-2026-82252)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of rust installed on the remote host is prior to 1.97.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3808 advisory.

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

    gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to     inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a     symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external     files as submodule configuration and expose attacker-controlled name, path, and url values.
    (CVE-2026-82252)

    gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability.
    The submodule name validation function in gix-validate only checks the first occurrence of '..' via     name.find(b..), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally     this validation is never invoked in production code paths. Combined with a trust inheritance flaw in     Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership     verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on     gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust,     bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. (CVE-2026-82253)

    gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from     attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch     operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)

    gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport     backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability     occurs because credential validation checks the original URL instead of the effective URL after redirect,     allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP     downgrades. (CVE-2026-82255)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1951 advisory.

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

    gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to     inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a     symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external     files as submodule configuration and expose attacker-controlled name, path, and url values.
    (CVE-2026-82252)

    gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from     attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch     operations to trigger panics or out-of-memory process kills. (CVE-2026-82254)

    gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport     backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability     occurs because credential validation checks the original URL instead of the effective URL after redirect,     allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP     downgrades. (CVE-2026-82255)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
365274	Amazon Linux 2023 : cargo-c (ALAS2023-2026-3181)	Nessus	Amazon Linux Local Security Checks	Local	high
342017	Linux Distros Unpatched Vulnerability : CVE-2026-82252	Nessus	Misc.	Local	high
328831	Amazon Linux 2 : rust (ALAS-2026-3808)	Nessus	Amazon Linux Local Security Checks	Local	high
328502	Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-1951)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-82252

high

Tenable Plugins

high

high

high

high