Vendor
gix and gitoxide Repository Boundary Violation via Symlinked .gitmodules
2 rules 1 TTP 1 IOCA vulnerability in gix and gitoxide allows a malicious repository to use a symlinked `.gitmodules` file pointing outside the repository, leading to the parsing of arbitrary, attacker-controlled submodule configurations and potential manipulation of downstream git operations.
gix and gitoxide Submodule Path Traversal Vulnerability
2 rules 1 TTPA path traversal vulnerability exists in gix and gitoxide where unvalidated submodule names from `.gitmodules` can be used to escape the `.git/modules` directory, potentially leading to repository confusion by redirecting submodule state inspection and open operations to attacker-controlled paths.
gitoxide Arbitrary Command Execution via .gitmodules Bypass
2 rules 1 TTP 1 CVEA vulnerability in gitoxide's `gix_submodule::File::update()` allows arbitrary command execution via a crafted `.gitmodules` file by incorrectly validating the source of the `update` command, enabling an attacker to inject malicious commands after a submodule has been initialized.