Threats tagged 'brew-snakemake-cve-2026-110860'

GitPython's Submodule.move() API does not properly validate symbolic links in the destination path, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an unintended external directory, corrupting the parent repository's index and configuration. The vulnerability requires an attacker to supply a malicious Git repository with a symlinked path and the application to call Submodule.move() on a path beneath that symlink. No code execution or confidentiality impact is demonstrated, but the integrity of the repository is compromised.