Description
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitoxideLabs | gitoxide | < 0.38.2 | 0.38.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-gix-credentials | 0.39.1-1 | — |
| Debian 13 | rust-gix-credentials | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-gix-credentials | No fix yet | — |
| Ubuntu 26.04 LTS | rust-gix-credentials | No fix yet | — |
| Ubuntu 24.04 LTS | rust-gix-credentials | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | cargo-c | 0.10.25-1.amzn2023.0.1 | ALAS2023-2026-3181 |
| Amazon Linux 2023 | rust +14 | 1.99.1-1.amzn2023 | ALAS2023-2026-3382 |
| Amazon Linux 2 | rust +11 | 1.99.1-1.amzn2 | ALAS2-2026-4072 |
Advisories 3
- ALAS2023-2026-3382 Moderate: rust security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4072 Moderate: rust security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3181 Important: rust-cargo-c security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
References
- GitHub Security Advisory (GHSA-6wr8-3w4h-j9wj) vendor-advisory
- VulnCheck Advisory: gitoxide before 0.38.2 Credential Helper Protocol Field Injection third-party-advisory