What is GHSA-66gr-hvvc-vvxc?

GHSA-66gr-hvvc-vvxc is a security advisory published by GitHub Security Advisories with High severity. gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing...

Which CVE IDs does GHSA-66gr-hvvc-vvxc cover?

GHSA-66gr-hvvc-vvxc covers the following CVE IDs: CVE-2026-82251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-66gr-hvvc-vvxc?

GHSA-66gr-hvvc-vvxc has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-66gr-hvvc-vvxcHighCVSS 7.5

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-82251 →

📋 Description

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

🔗 References (4)

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h
https://nvd.nist.gov/vuln/detail/CVE-2026-82251
https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name
https://github.com/advisories/GHSA-66gr-hvvc-vvxc