CVE-2026-82251 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability stems from a failure to validate submodule names sourced from the .gitmodules configuration file. Attackers can craft malicious submodule names containing path traversal segments (e.g., '../') to redirect internal functions such as state() and open() to arbitrary repository locations outside the intended .git/modules directory. This can lead to repository confusion, where the application interacts with attacker-controlled repositories instead of legitimate ones. The impact includes potential inspection and manipulation of unintended repository data. The fix was introduced in gitoxide version 0.52.1. Users are advised to upgrade immediately to mitigate the risk of exploitation in environments that process untrusted repositories or submodule configurations.
