CVE-2026-114097: Python Git Tree Materialized Into Cwd Symlink Writecve-2026-114097-python-git-tree-materialized-into-cwd-symlink-write
build_index_from_tree() is called with the process current working directory ($ROOT) as root_path, so every entry of the given git tree — including symlink entries (mode 120000) whose attacker-controlled target blob is passed straight to os.symlink() — is materialized into the CWD and left on disk. In iterative operations over untrusted history (e.g. a filte
