Impact An attacker-controlled repository (hosted by the attacker rather than on a normal forge site) can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code. Patches Patches are being discussed on the git-security mailing list. Workarounds As always, it is best to avoid cloning repositories from untrusted sources. We currently believe this can only be triggered when the `--recurse-submodules` option is used. References - `git clone --recurse-submodules`