CVE-2026-82249
Low · 3.1CVSS
3.1
EPSS
—
Published
Aug 28, 2026
CISA due date
—
The record
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-116
- CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-processing… CWE-116
- CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. CWE-116
- CVE-2026-106444 Handlebars provides the power necessary to let users build semantic templates. CWE-116
- CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-116
- CVE-2026-88060 Angular is a development platform for building mobile and desktop web applications using… CWE-116