Credential Helper Protocol Field Injection in Gitoxide
CVE-2026-82249

2.3LOW

Key Information:

Vendor

Gitoxidelabs

Status
Gitoxide
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82249?

The vulnerability in Gitoxide occurs when the application fails to properly validate carriage return characters in URLs passed to credential helpers. This oversight allows attackers to craft malicious URLs containing bare carriage returns, leading to the injection of additional protocol fields. As a result, credential helpers may return credentials for hosts specified by the attacker instead of the intended URL, posing significant security risks.

Affected Version(s)

gitoxide 0 < 0.38.2

gitoxide 0.38.2

References

https://github.com/GitoxideLabs/gitoxide/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-before-0.38...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hibrian827
.