Summary
gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
attachments:
pocs.zip
When Repository::submodules() loads submodule metadata, it prefers the worktree .gitmodules file if that path exists. In the current implementation, the path is read with std::fs::read(), which follows symlinks. As a result, a repository can present a symlinked .gitmodules that points outside the repository, and gitoxide will parse the out-of-repository bytes as submodule configuration.
This is a repository-boundary violation. A caller using the high-level submodule API can believe it is reading repository-local submodule metadata, while the bytes are actually coming from an arbitrary file outside the repository tree.
Root cause analysis
The relevant flow is:
gix/src/repository/location.rsderives the worktree.gitmodulespath asworkdir/.gitmodules.gix/src/repository/submodule.rsreads that path withstd::fs::read(&path)and immediately parses the bytes as a submodule configuration file.Repository::submodules()exposes the parsed entries through the high-level API.
The issue is not in the parser. The issue is that the worktree path is treated as an ordinary file without checking whether it is a symlink, and without checking whether the canonicalized target remains inside the repository worktree.
Because std::fs::read() follows symlinks, a malicious repository can cause gitoxide to ingest bytes from an attacker-chosen location outside the repository. The resulting Submodule objects then expose name, path, and url values derived from that external file.
Reproduction steps
Use the attached PoC zip that contains the pocs/ workspace.
Unzip the PoC archive.
Enter
pocs/F001.Run:
cargo run --quietCompare the output with
pocs/F001/result.txt.
Important outputs include:
gitmodules_symlink=.../victim-repo/.gitmodulessymlink_target=.../outside/modules.confparsed_name=symlinkedparsed_path=deps/symlinkedparsed_url=https://attacker.example/symlinked.git
These outputs show that gitoxide parsed the submodule configuration from the symlink target outside the repository, not from repository-local bytes.
Impact
Confirmed impact:
- out-of-repository bytes can be injected into the result of
Repository::submodules(); - callers can be misled about submodule metadata such as
name,path, andurl; - any downstream workflow that uses those values to decide clone, fetch, update, or policy behavior is operating on attacker-controlled data that did not actually originate from the repository tree.
This report does not claim direct command execution from this code path by itself. The demonstrated impact is metadata injection across the repository boundary.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
A safe fix is to stop silently following symlinks for the worktree .gitmodules path in this loading path.
Reasonable options include:
- use
symlink_metadata()/lstatstyle checks and reject symlinked.gitmoduleswhen loading from the worktree; - canonicalize the target and verify that it still resides under the repository worktree before reading it;
- for security-sensitive callers, prefer loading
.gitmodulesfrom the index orHEADtree rather than following the worktree path.
At minimum, the worktree path should not silently follow symlinks to arbitrary external files.
Frequently Asked Questions
- What is GHSA-PG4W-G64P-QWHJ? GHSA-PG4W-G64P-QWHJ is a high-severity path traversal vulnerability in gitoxide (rust), affecting versions <= 0.52.0. It is fixed in 0.52.1, 0.83.0. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which packages are affected by GHSA-PG4W-G64P-QWHJ?
gitoxide(rust) (versions <= 0.52.0)gix(rust) (versions < 0.83.0)
- Is there a fix for GHSA-PG4W-G64P-QWHJ? Yes. GHSA-PG4W-G64P-QWHJ is fixed in 0.52.1, 0.83.0. Upgrade to this version or later.
- Is GHSA-PG4W-G64P-QWHJ exploitable, and should I be worried? Whether GHSA-PG4W-G64P-QWHJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-PG4W-G64P-QWHJ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-PG4W-G64P-QWHJ?
- Upgrade
gitoxideto 0.52.1 or later - Upgrade
gixto 0.83.0 or later
- Upgrade