gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.

CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises because gitoxide follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When gitoxide parses this file, it processes attacker-controlled content as legitimate submodule configuration. This exposes arbitrary name, path, and URL values that could be used to manipulate submodule behavior. The issue represents a repository boundary violation, a class of vulnerability also seen in other Git implementations. Users are advised to upgrade to gitoxide 0.52.1 or later to remediate the issue.