gitoxide, a Rust implementation of git, versions before 0.21.1 contain a CWE-59 (Improper Link Resolution Before File Access) vulnerability. During checkout, symlink index entries are deferred and created after regular files using a shared stack structure. The caching of validated path prefixes causes a bypass of critical checks that normally prevent unsafe symlink creation. Specifically, the on-disk symlink metadata check and unlink-on-collision logic are skipped for cached prefixes, allowing creation of symlinks that follow parent directories. This can be exploited by providing a tree with duplicate symlink and directory entries, enabling writing attacker-controlled symlinks into arbitrary directories writable by the user. The vulnerability is resolved in version 0.21.1.

Successful exploitation allows an attacker to write symbolic links controlled by the attacker into any directory where the user has write access during a git checkout operation. This can lead to arbitrary file system modifications, potentially resulting in code execution, privilege escalation, or disruption of system integrity. The CVSS 3.1 base score is 7.8 (High), reflecting the local attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

A fix for this vulnerability is available in gitoxide version 0.21.1. Users and administrators should upgrade to version 0.21.1 or later to remediate this issue. No other vendor advisories or temporary mitigations are provided. Patch status is confirmed by the vendor's versioning information.