Gitoxide

The gitoxide gix-fs library before version 0.23.0 is vulnerable to a path validation bypass during worktree checkout that allows arbitrary file writes outside the intended directory via symlink manipulation.

A path traversal and trust inheritance vulnerability in the gitoxide Rust crates allows attackers to access arbitrary git configurations by crafting malicious .gitmodules files.

An improper URL parsing flaw in the gitoxide gix-url crate enables credential theft by causing the gix-transport identity guard to transmit HTTP Basic Authorization headers to unauthorized hosts via crafted redirects.

Gitoxide versions prior to 0.52.1 contain a path traversal vulnerability via symlink following that allows attackers to inject arbitrary file contents into submodule configuration metadata.