{"action":"Upgrade gix to 0.83.0 or later.","affected":[{"fixed":"0.83.0","introduced":"0"}],"component":"gix","cve_ids":["CVE-2026-82251"],"ecosystem":"crates.io","epss":0.00522,"exploited":false,"fixed_versions":["0.83.0"],"ghsa_id":"GHSA-fr8x-3vfx-f45h","id":"tcs_01M5KEXMGCXYWRACY4AHE659RY","modified_at":"2026-09-10T03:51:05.722846150Z","published_at":"2026-05-05T19:27:51Z","references":["https://osv.dev/vulnerability/GHSA-fr8x-3vfx-f45h","https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h","https://github.com/GitoxideLabs/gitoxide"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-fr8x-3vfx-f45h#crates.io/gix","url":"https://osv.dev/vulnerability/GHSA-fr8x-3vfx-f45h"}],"summary":"gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository"}