PT-2026-45483

Name of the Vulnerable Software and Affected Versions kas versions prior to 5.3 Description Users relying exclusively on a git commit ID SHA-1 or SHA-256 to verify if a repository checkout matches a validated state in a kas configuration may be deceived into checking out a branch with the same...

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

Summary attachments: pocs.zip Submodule names coming from .gitmodules are exposed as unvalidated names and are later reused to derive the submodule git directory as: /modules/ Because the submodule name is joined directly as a filesystem path component, a name such as ../../../escaped-target.git...

The vulnerability of the Python library for interacting with git repositories like gitpython, related to improper input validation, allows a malicious actor to inject a malicious remote URL address into the cloning command.

The vulnerability of the Python library for interacting with git repositories called gitpython is related to external git calls that lack proper parameter sanitization. Exploiting this vulnerability allows a malicious actor to inject a malicious remote URL address as part of a cloning command...