Weakness
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
References
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.