CVE-2026-82249: gitoxide before 0.38.2 Credential Helper Protocol Field Injection

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-28
Weakness: CWE-116

Description

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.

Affected products

GitoxideLabs gitoxide: before 0.38.2 — fixed in 0.38.2

How to fix

Upgrade to a fixed version: GitoxideLabs gitoxide 0.38.2. Check the vendor advisory for mitigations.

References

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6wr8-3w4h-j9wj
https://www.vulncheck.com/advisories/gitoxide-before-0.38.2-credential-helper-protocol-field-injection

Get alerted when CVE-2026-82249 or the next vulnerability affects your stack