The vulnerability exists in gitoxide before version 0.52.1, where the software follows symlinks when reading the worktree .gitmodules file. This allows attackers to inject out-of-repository bytes into submodule metadata by creating a malicious repository with a symlinked .gitmodules pointing outside the repository tree. Users of gitoxide, especially those using versions before 0.52.1, should be aware of t [truncated]
The gitoxide library before version 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal attacks. This vulnerability can be exploited by crafting malicious submodule names with traversal segments, potentially redirecting state() and open() functions to repositories outside .git/modules. Affected systems should be updated to version 0.52.1 or later, and compensat [truncated]
