---
id: "CVE-2026-123532"
page: "https://infrastack.ai/live/CVE-2026-123532"
kind: "vulnerability"
aliases: ["CVE-2026-123532"]
title: "gitoxide: Windows checkout leaks NTLM credentials via crafted UNC symlinks"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["git", "gitoxide", "package", "rust", "windows"]
not_affected_if: ["git-cli-only", "linux-or-macos-only", "trusted-repositories-only"]
published_at: "2026-11-08T02:16:43+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123532", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# gitoxide: Windows checkout leaks NTLM credentials via crafted UNC symlinks

Link for people: https://infrastack.ai/live/CVE-2026-123532 (this .md is for agents)

gitoxide's gix-fs crate, before 0.24.1, follows UNC symlink targets in a crafted repository when a victim checks it out on Windows with symlinks enabled. That triggers SMB authentication, which leaks the victim's username, domain and NTLMv2 hash to an attacker-controlled server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the gitoxide version in your Cargo.lock for `gix-fs`; versions below `0.24.1` are affected.
- Check whether your Windows build or checkout tooling uses gitoxide (`gix`) to clone or check out untrusted repositories with symlinks enabled.

## Fix

- gitoxide (gix-fs): `0.24.1`

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123532

## Documents

- [advisory] Vendor advisory: github.com https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-xw69-xv93-5fjv
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gix-fs-before-0.24.1-ntlm-credential-disclosure-via-windows-symlink-unc-probe

## From the sources

gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_