Symlink Vulnerability in gitoxide by GitoxideLabs

CVE-2026-44471

What is CVE-2026-44471?

A vulnerability in gitoxide prior to version 0.21.1 allows an attacker to construct a malicious tree that can create symlinks within any user-accessible directory. This occurs because during the checkout process, symlink entries are created after regular files, which allows the exploitation of directory structures using cached path prefixes. As a result, users could inadvertently create symlinks controlled by the attacker, leading to potential security risks such as unauthorized access to sensitive data. The issue has been resolved in version 0.21.1, which mitigates the symlink creation flaw by enforcing appropriate checks.

References