Threats tagged 'brew-mistral-vibe-cve-2026-110860'

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink in a cloned repository to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-selected directory outside the worktree, corrupting the parent repository's index and configuration. The vulnerability requires the application to call Submodule.move() explicitly with a path under the symlink and affects GitPython versions before 3.0.3. No code execution or confidentiality impact is demonstrated.