CVE-2026-91986: Gitoxidelabs Gitoxide

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.

Affected products

• Gitoxidelabs Gitoxide: before 0.59.2 (fixed in 0.59.2)

Published 2026-09-15. Last modified 2026-09-23.