CyberRota Analysis
AI-GeneratedGitoxide versions prior to 0.52.1 are vulnerable due to improper handling of symlinks in the .gitmodules file, allowing attackers to inject malicious submodule metadata from outside the repository. This can lead to the exposure of attacker-controlled values, potentially compromising the integrity of the repository and its submodules. Organizations using gitoxide should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to parse arbitrary external files as submodule configuration and expose attacker-controlled name, path, and url values.