CVE-2017-17458: Mercurial vulnerable to arbitrary code injection

The vulnerability stems from Mercurial's handling of Git subrepositories, where a malicious .git/hooks/post-update script could be executed. The functions in the Git subrepo module (gitsubrepo) that process updates or checkouts (e.g., _update, get) are directly responsible for interacting with the subrepo's configuration and hooks. The fixes in Mercurial 4.4.1 (e.g., disallowing symlink traversal and adding subrepo operation restrictions) imply these functions lacked proper validation. The CWE-78 classification confirms the issue involves improper neutralization of OS commands, aligning with the described attack vector.