GHSA-p3hw-mv63-rf9w
NoneCVSS
—
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | gix | 0 | 0.83.0 |
| crates.io | gix-validate | 0 | 0.11.1 |
Related vulnerabilities
- GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects… Also affects gix
- GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the… Also affects gix
- GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update()… Also affects gix
- CVE-2024-35186 gitoxide is a pure Rust implementation of Git. Also affects gix
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200