Gitoxide (< 0.52.1)

Gitoxide versions prior to 0.52.1 contain a path traversal vulnerability via symlink following that allows attackers to inject arbitrary file contents into submodule configuration metadata.