{"id":"CVE-2026-40034","title":"gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initia…","summary":"gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initia…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-77"],"vendor":"gitoxide","product":"gitoxide","affected":["gitoxide < 0.5.21","gix-submodule < 0.29.0","gix < 0.84.0"],"patched":["gix 0.83.0"],"published":"2026-05-26","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:14.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40034","references":[{"url":"https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0","label":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc","label":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65","label":"disclosure@vulncheck.com"},{"url":"https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule","label":"disclosure@vulncheck.com"},{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40034"},{"url":"https://github.com/GitoxideLabs/gitoxide"}],"tags":["nvd","cve.org","exploit-available","osv","rust"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-05-26T15:00:27.629890Z"},"epss":0.00651,"epssPercentile":0.51002,"aliases":["GHSA-f26g-jm89-4g65"],"ecosystem":"rust","ingestedAt":"2026-08-07T19:14:19.522Z","slug":"CVE-2026-40034","body":"## Overview\n\ngix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-40034)\n\nAffected packages:\n\n- `gix >= 0.31.0, < 0.83.0`\n\nPatched in:\n\n- `gix 0.83.0`\n\nSource: https://osv.dev/vulnerability/GHSA-f26g-jm89-4g65","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":218110,"id":"CVE-2026-40034","ts":1791478396165,"field":"exploit_available","old":"false","new":"true"}]}