Gitoxide repository boundary violation (GHSA-ggw6-g4qp-qw7f)

Vulnerability Summary: Gitoxide Repository Boundary Violation (GHSA-ggw6-g4qp-qw7f) Vulnerability Overview Title: Symlinked is followed and parsed from outside the repository Type: Repository boundary violation Root Cause: When loads submodule metadata, it prioritizes reading the file from the working tree without checking if the path is a symbolic link. Since follows symlinks, a malicious repository can cause gitoxide to read bytes from an arbitrary file outside the repository tree and parse them as submodule configuration. Impact: - Bytes from outside the repository can be injected into the results of ; - Callers may make incorrect decisions based on tampered submodule metadata (such as , , ); - Downstream workflows that rely on these values for , , , or policy decisions will operate on attacker-controlled data. - This vulnerability does not claim direct command execution; the impact is metadata injection. Affected Scope Severity: Moderate CVE: No known CVE Weakness: No CWE Credits: NizoltUO Reproduction Steps (POC) 1. Unpack the PoC archive (which contains the working tree). 2. Navigate to . 3. Run: 4. Compare the output with . Key outputs include: These outputs demonstrate that gitoxide parsed the submodule configuration from the symlink target (outside the repository) rather than from local repository bytes. Recommended Fix Core idea: Stop silently following symlinks in the working tree path. Reasonable options: 1. Use / lstat-style checks to reject a symlinked when loading from the working tree; 2. Normalize the target path and verify it remains within the repository working tree, rather than reading an arbitrary file; 3. For security-sensitive callers, prioritize loading from the index or HEAD instead of following the working tree path. Minimum requirement: The working tree path must not silently follow symlinks that point to arbitrary external files.

Goal Reached Thanks to every supporter — we hit 100%!

Gitoxide repository boundary violation (GHSA-ggw6-g4qp-qw7f)

More from this source