{"action":"Upgrade gitoxide to 0.52.1 or later.","affected":[{"fixed":"0.52.1","introduced":"0"}],"component":"gitoxide","cve_ids":["CVE-2026-82251"],"ecosystem":"crates.io","epss":0.00522,"exploited":false,"fixed_versions":["0.52.1"],"ghsa_id":"GHSA-fr8x-3vfx-f45h","id":"tcs_01M5KEXMA7NS4CFYM86DBX7N4Z","modified_at":"2026-09-10T03:51:05.722846150Z","published_at":"2026-05-05T19:27:51Z","references":["https://osv.dev/vulnerability/GHSA-fr8x-3vfx-f45h","https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h","https://github.com/GitoxideLabs/gitoxide"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-fr8x-3vfx-f45h","url":"https://osv.dev/vulnerability/GHSA-fr8x-3vfx-f45h"}],"summary":"gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository"}