CVE-2026-82249 LOW

CVE-2026-82249: gitoxide before 0.38.2 Credential Helper Protocol Field Injection

Vendor Gitoxidelabs
Product gitoxide
Weakness CWE-116
Published August 28, 2026
Last update August 28, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.

Key dates

02Disclosure timeline

August 28, 2026 CVE published
August 28, 2026 Record updated