Threats tagged 'brew-jiratui-cve-2026-110860'

GitPython's Submodule.move() API does not properly validate intermediate symlinks in the destination path, allowing an attacker-controlled symlink to redirect a submodule move operation outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-chosen directory outside the repository, corrupting the parent repository's index and configuration. The issue affects GitPython 3.1.62 and current main branch. No code execution or confidentiality impact is demonstrated.