gitoxide, an implementation of git in Rust, has a flaw that allows a malicious repository tree to be constructed so that when the repository is checked out, the tool creates attacker‑controlled symlinks in any directory the user can write to. The bug arises from symlink prefix reuse during the checkout phase, which bypasses the normal directory creation checks and accepts symlinks that traverse out of the intended worktree. This is a path‑confusion type vulnerability (CWE‑59) that can lead to overwriting files, enabling local elevation of privilege or execution of arbitrary code if the attacker can place a malicious binary where the user has write access.

The vulnerability affects GitoxideLabs:gitoxide, specifically versions older than 0.21.1. Any system running a pre‑0.21.1 release of gitoxide and who has write permissions to the target directory during a checkout is at risk. Users who clone or fetch repositories from untrusted sources with these older versions could have the repository written outside the intended working directory.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to supply a specially crafted repository and a user with write access to a target directory. The vulnerability is local; it cannot be exploited remotely over a network connection. However, once the user runs gitoxide on the malicious repository, arbitrary files can be written or replaced, potentially facilitating privilege escalation or code execution.