Log in Start free

Vulnerability · Published May 26, 2026 · Assigned by VulnCheck

CVE-2026-40034gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

High 7.8

In plain English

A high-severity command injection in gitoxide from gitoxide. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 48.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-gix-submoduleno fix listedDEBIAN-CVE-2026-40034
Debian:14rust-gix-submodule0.30.0-1DEBIAN-CVE-2026-40034
Ubuntu:25.10rust-gixno fix listedUBUNTU-CVE-2026-40034
Ubuntu:26.04:LTSrust-gixno fix listedUBUNTU-CVE-2026-40034
Ubuntu:26.10rust-gixno fix listedUBUNTU-CVE-2026-40034
Ubuntu:25.10rust-gix-submoduleno fix listedUBUNTU-CVE-2026-40034
Ubuntu:26.04:LTSrust-gix-submoduleno fix listedUBUNTU-CVE-2026-40034
Ubuntu:26.10rust-gix-submoduleno fix listedUBUNTU-CVE-2026-40034

Affected products (as reported)

VendorProductVersions
gitoxide gitoxide 0 – before 0.5.21
gitoxide gix-submodule 0 – before 0.29.0
gitoxide gix 0 – before 0.84.0

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References