Threats affecting pkg:cargo/gix

gix-submodule versions from 0.31.0 up to but not including 0.83.0 have a vulnerability in the validation of the update field in .gitmodules. This flaw allows attackers to bypass command execution restrictions and inject arbitrary shell commands that execute during submodule updates. The advisory is a duplicate and has been withdrawn in favor of another GHSA identifier. No patch or remediation details are provided in this advisory.

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

A path traversal vulnerability in gitoxide allows unvalidated submodule names from .gitmodules to escape the intended .git/modules directory. This causes Submodule::state() and Submodule::open() to operate on attacker-chosen repository paths outside the modules directory. The issue arises because submodule names are directly used as filesystem path components without confinement checks or normalization. This can lead to repository confusion where operations on submodules are redirected to unintended repositories. No direct code execution is claimed, but the impact is significant repository redirection.

gitoxide versions prior to 0.52.1 and 0.83.0 have a vulnerability where the .gitmodules file in the worktree can be a symlink pointing outside the repository. This causes the submodule metadata API to parse and expose attacker-controlled data from outside the repository boundary. The flaw allows injection of arbitrary submodule configuration metadata, misleading downstream workflows that rely on this data. No direct code execution is claimed, but the integrity of submodule metadata is compromised.

A vulnerability in the gix library allows bypassing submodule name validation and exploits a trust inheritance flaw in submodule handling. This enables path traversal via crafted .gitmodules files, allowing an attacker to cause gitoxide-based tools to open arbitrary git repository directories with full trust. As a result, sensitive configuration data including credentials can be disclosed. The issue arises because validation only checks the first '..' sequence and is not enforced in production code, combined with the submodule open function inheriting full trust from the parent repository without ownership verification. Fixed versions 0.83.0 and 0.11.1 address these issues.