`git subtree`s causes commits from sub-repository to be incorrectly included in parent repo commit ranges

**Describe the bug**

Querying for a specific commit a06ef4e1a127795606642c55e22d4f2945edc061 for https://github.com/jquery/jquery-mousewheel.git at tag 3.0.6, we get many CVEs for an unrelated project https://github.com/librenms/librenms. I guess this commit is incorrectly tagged somehow?

**To Reproduce**
```
curl -d '{"commit": "a06ef4e1a127795606642c55e22d4f2945edc061"}' "https://api.osv.dev/v1/query"
```

Output:
```
{
"vulns": [
{
"id": "CVE-2017-16759",
"details": "The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.",
"aliases": [
"GHSA-4ccx-wjqp-5fww"
],
"modified": "2025-04-20T03:49:18.841576Z",
"published": "2017-11-09T22:29:00Z",
"references": [
{
"type": "ARTICLE",
"url": "https://blog.librenms.org/2017/08/22/librenms-security-fix-during-the-installation-process/"
},
{
"type": "FIX",
"url": "https://github.com/librenms/librenms/commit/7887b2e1c7158204ac69ca43beafce66e4d3a3b4"
},
{
"type": "FIX",
"url": "https://github.com/librenms/librenms/commit/d3094fa6578b29dc34fb5a7d0bd6deab49ecc911"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/pull/7184"
}
],
"affected": [
{
"ranges": [
{
"type": "GIT",
"repo": "https://github.com/librenms/librenms",
"events": [
{
"introduced": "0"
},
{
"fixed": "7887b2e1c7158204ac69ca43beafce66e4d3a3b4"
},
{
"fixed": "7887b2e1c7158204ac69ca43beafce66e4d3a3b4"
},
{
"fixed": "d3094fa6578b29dc34fb5a7d0bd6deab49ecc911"
},
{
"fixed": "d3094fa6578b29dc34fb5a7d0bd6deab49ecc911"
}
]
}
],
"versions": [
"0.1",
"1.19",
"1.20",
"1.21",
"1.25",
"1.26",
"1.27",
"1.28",
"1.29",
"1.30",
"201505",
"201506",
"201507",
"201508",
"201509",
"201510",
"201511",
"201512",
"201601",
"201602",
"201603",
"201604",
"201605",
"201606",
"201607",
"201608",
"20160828",
"201609"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16759.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
]
},
{
"id": "CVE-2018-18478",
"details": "Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and html/includes/forms/edit-dashboard.inc.php.",
"aliases": [
"GHSA-9m82-f3wx-p625"
],
"modified": "2025-01-14T07:26:33.349262Z",
"published": "2018-10-18T17:29:00Z",
"references": [
{
"type": "REPORT",
"url": "https://github.com/librenms/librenms/issues/9170"
},
{
"type": "WEB",
"url": "https://hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistente/"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/pull/9171"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/releases/tag/1.44"
}
],
"affected": [
{
"ranges": [
{
"type": "GIT",
"repo": "https://github.com/librenms/librenms",
"events": [
{
"introduced": "0"
},
{
"fixed": "f049593c7b1723d050a0124a9e877cb97ca0ca6d"
}
]
}
],
"versions": [
"0.1",
"1.19",
"1.20",
"1.21",
"1.25",
"1.26",
"1.27",
"1.28",
"1.29",
"1.30",
"1.30.01",
"1.31",
"1.31.01",
"1.31.02",
"1.31.03",
"1.32",
"1.33",
"1.35",
"1.36",
"1.37",
"1.38",
"1.39",
"1.40",
"1.41",
"1.42",
"1.42.01",
"1.43",
"201505",
"201506",
"201507",
"201508",
"201509",
"201510",
"201511",
"201512",
"201601",
"201602",
"201603",
"201604",
"201605",
"201606",
"201607",
"201608",
"20160828",
"201609"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18478.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
]
},
{
"id": "CVE-2018-20434",
"details": "LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.",
"aliases": [
"GHSA-62q7-qj6g-gvr7"
],
"modified": "2025-01-14T07:28:53.464209Z",
"published": "2019-04-24T21:29:00Z",
"references": [
{
"type": "WEB",
"url": "https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d"
},
{
"type": "WEB",
"url": "https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434/"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153188/LibreNMS-addhost-Command-Injection.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153448/LibreNMS-1.46-addhost-Remote-Code-Execution.html"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing"
}
],
"affected": [
{
"ranges": [
{
"type": "GIT",
"repo": "https://github.com/librenms/librenms",
"events": [
{
"introduced": "0"
},
{
"last_affected": "bd5e692dc778ff7e7e05e5765baa2ad584154589"
}
]
}
],
"versions": [
"0.1",
"1.19",
"1.20",
"1.21",
"1.25",
"1.26",
"1.27",
"1.28",
"1.29",
"1.30",
"1.30.01",
"1.31",
"1.31.01",
"1.31.02",
"1.31.03",
"1.32",
"1.33",
"1.35",
"1.36",
"1.37",
"1.38",
"1.39",
"1.40",
"1.41",
"1.42",
"1.42.01",
"1.43",
"1.44",
"1.45",
"1.46",
"201505",
"201506",
"201507",
"201508",
"201509",
"201510",
"201511",
"201512",
"201601",
"201602",
"201603",
"201604",
"201605",
"201606",
"201607",
"201608",
"20160828",
"201609"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20434.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
]
},
{
"id": "CVE-2018-20678",
"details": "LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.",
"aliases": [
"GHSA-4fwh-r866-pvh9"
],
"modified": "2025-01-14T07:30:02.982362Z",
"published": "2019-03-28T16:29:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://cert.enea.pl/advisories/cert-190101.html"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/commits/master/html/ajax_table.php"
}
],
"affected": [
{
"ranges": [
{
"type": "GIT",
"repo": "https://github.com/librenms/librenms",
"events": [
{
"introduced": "0"
},
{
"last_affected": "03d6d76908b21612988af0ab112a787863ba183a"
}
]
}
],
"versions": [
"0.1",
"1.19",
"1.20",
"1.21",
"1.25",
"1.26",
"1.27",
"1.28",
"1.29",
"1.30",
"1.30.01",
"1.31",
"1.31.01",
"1.31.02",
"1.31.03",
"1.32",
"1.33",
"1.35",
"1.36",
"1.37",
"1.38",
"1.39",
"1.40",
"1.41",
"1.42",
"1.42.01",
"1.43",
"1.44",
"1.45",
"1.46",
"1.47",
"201505",
"201506",
"201507",
"201508",
"201509",
"201510",
"201511",
"201512",
"201601",
"201602",
"201603",
"201604",
"201605",
"201606",
"201607",
"201608",
"20160828",
"201609"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20678.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
]
},
{
"id": "CVE-2019-10665",
"details": "An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.",
"aliases": [
"GHSA-q5rg-wg7h-73m5"
],
"modified": "2025-01-14T07:43:46.762918Z",
"published": "2019-09-09T13:15:11Z",
"references": [
{
"type": "WEB",
"url": "https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/"
}
],
"affected": [
{
"ranges": [
{
"type": "GIT",
"repo": "https://github.com/librenms/librenms",
"events": [
{
"introduced": "0"
},
{
"last_affected": "03d6d76908b21612988af0ab112a787863ba183a"
}
]
}
],
"versions": [
"0.1",
"1.19",
"1.20",
"1.21",
"1.25",
"1.26",
"1.27",
"1.28",
"1.29",
"1.30",
"1.30.01",
"1.31",
"1.31.01",
"1.31.02",
"1.31.03",
"1.32",
"1.33",
"1.35",
"1.36",
"1.37",
"1.38",
"1.39",
"1.40",
"1.41",
"1.42",
"1.42.01",
"1.43",
"1.44",
"1.45",
"1.46",
"1.47",
"201505",
"201506",
"201507",
"201508",
"201509",
"201510",
"201511",
"201512",
"201601",
"201602",
"201603",
"201604",
"201605",
"201606",
"201607",
"201608",
"20160828",
"201609"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10665.json"
}
}
],
"schema_version": "1.6.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
]
},
{
...
```

**Expected behaviour**
Most likely `[]`