CVE catalog

CVE-2026-82252

DEBIAN-CVE-2026-82252

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.52% · Oct 25, 2026

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-gix130.69.1-1vulnerable
Debianrust-gix130.69.1-2vulnerable
Debianrust-gix130.73.0-1vulnerable
Debianrust-gix130.73.0-2vulnerable
Debianrust-gix130.73.0-3vulnerable
Debianrust-gix130.73.0-4vulnerable
Debianrust-gix130.83.0-1vulnerable
Debianrust-gix130.83.0-2vulnerable
Debianrust-gix130.86.0-1vulnerable
Debianrust-gix130.87.1-1vulnerable
Debianrust-gix140.69.1-1vulnerable
Debianrust-gix140.69.1-2vulnerable
Debianrust-gix140.73.0-1vulnerable
Debianrust-gix140.73.0-2vulnerable
Debianrust-gix140.73.0-3vulnerable
Debianrust-gix140.73.0-4vulnerable
Debianrust-gix140.83.0-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-gixdeb140.83.0-1Not reportedDEBIAN-CVE-2026-82252Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-gix-dev]Affected

    Source package: [rust-gix]

    Details (2)

    • 0.69.1-1 · amd64 · trixie

      Affected

      pypi · rust-gix · debian · 13

    • 0.69.1-1 · arm64 · trixie

      Affected

      pypi · rust-gix · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]