gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.

CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises from gitoxide following symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external file content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When parsed, gitoxide reads the external file as submodule configuration, exposing attacker-controlled name, path, and URL values. This constitutes a repository boundary violation that could be exploited during repository cloning or processing operations. The fix is available in gitoxide version 0.52.1 and above. The issue is classified as high severity due to the potential for metadata injection and manipulation of submodule configurations.