CVE-2026-40034

HIGH

gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

Title source: cna
STIX 2.1

Description

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory
GHSA Advisory GHSA-f26g-jm89-4g65
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65
Third Party Advisory third-party-advisory
Anthropic CVD Finding ANT-2026-6SNS6KMP
https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP
Third Party Advisory third-party-advisory
VulnCheck Advisory: gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule

Scores

CVSS v3 7.8
EPSS 0.0036
EPSS Percentile 27.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-77
Status published
Products (8)
gitoxide/gitoxide < 0.5.21
gitoxide/gitoxide < 0.82.0
gitoxide/gitoxide 0.5.21
gitoxide/gitoxide 0.82.0
gitoxide/gix < 0.84.0
gitoxide/gix 0.84.0
gitoxide/gix-submodule < 0.29.0
gitoxide/gix-submodule 0.29.0
Published May 26, 2026
Tracked Since May 26, 2026