This vulnerability in the go-git library allows specially crafted repositories to modify the main and submodule .git directories, potentially leading to unauthorized changes in repository metadata or configuration. The advisory is published by Microsoft Security Response Center and references Microsoft products such as Azure Linux 3.0 and packer, but does not specify exact affected versions or provide patch details. No CVSS score or exploit information is available, and no vendor advisory patch links are provided. The issue is classified under CWE-22, which typically involves improper handling of file or directory paths.

The impact involves unauthorized modification of the main and submodule .git directories in repositories processed by the go-git library. This could affect repository integrity or configuration, but the exact consequences are not detailed. No known exploits have been reported in the wild, and the severity is assessed as medium based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Microsoft Security Response Center advisories for updates. Until a fix is available, cautious handling of untrusted repositories and restricting repository sources may reduce risk.