MGASA-2023-0066

Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GIT_DIR/objects directory contains symbolic links, the objects directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253 (CVE-2023-22490).

By feeding a crafted input to "git apply", a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946).