CVE Feed

    Dashboard / CVE / CVE-2026-40034

    CVE-2026-40034

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

    Published:May 26, 2026
    Last Modified:Jul 14, 2026
    EPS:May 26, 2026
    EPSS Score:0.00351
    CVSS Score:7.8

    Affected Products

    Vendor
    Gitoxidelabs
    Product
    Gitoxide

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82255 (CVSS 7.6) — gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backen…
    CVE-2026-82254 (CVSS 8.7) — gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from att…
    CVE-2026-82253 (CVSS 8.7) — gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The s…
    CVE-2026-82252 (CVSS 8.7) — gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inje…
    CVE-2026-82251 (CVSS 8.7) — gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path travers…
    CVE-2026-82250 (CVSS 7.1) — gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation tha…
    CVE-2026-82249 (CVSS 2.3) — gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers…
    CVE-2026-82248 (CVSS 6) — gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_…
    CVE-2026-82247 (CVSS 8.7) — gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or…
    CVE-2026-44471 (CVSS 7.8) — gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed tha…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High