Low severity3.1NVD Advisory· Published Aug 28, 2026

CVE-2026-82249

Description

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gitoxide/Gitoxidellm-fuzzy
Range: <0.38.2

Patches

Vulnerability mechanics

References

github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-6wr8-3w4h-j9wjnvd
www.vulncheck.com/advisories/gitoxide-before-0.38.2-credential-helper-protocol-field-injectionnvd

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000