Threats tagged 'brew-shallow-backup-cve-2026-110860'

GitPython's Submodule.move() API does not properly handle symbolic links in intermediate path components, allowing an attacker-controlled symlink in a cloned repository to redirect a submodule move operation outside the parent repository's worktree. This causes the submodule checkout to be moved to an attacker-chosen directory outside the expected location, corrupting the parent repository's index and configuration. The issue affects GitPython 3.1.62 and current main branch and requires the application to explicitly call Submodule.move() on a path beneath the symlink. No code execution or confidentiality impact is demonstrated.