Executive brief
Gitoxide is a Rust implementation of the Git version control system. A security flaw in how it handles submodules allows a malicious repository to execute arbitrary commands on a user's computer. This occurs when a user interacts with a repository containing a specially crafted submodule configuration that bypasses security checks intended to prevent unauthorized command execution.
Technical details
A vulnerability exists in gix_submodule::File::update() where the security guard intended to prevent arbitrary command execution from .gitmodules is incorrectly implemented. The function checks if any trusted configuration section (like .git/config) exists for a submodule, but fails to verify that the specific 'update' command value actually originated from that trusted section. If a submodule is initialized (creating a trusted section for the URL), an attacker can later add a malicious 'update = !<command>' entry to the untrusted .gitmodules file. Gitoxide will incorrectly attribute the command to the trusted section's existence and return the attacker-controlled command for execution. This bypasses the protection established in response to CVE-2019-19604.
Affected products
- GitoxideLabs gix >= 0.31.0, < 0.83.0
Timeline
- 2026-04-25: disclosed
- 2026-05-05: advisory: GHSA-f26g-jm89-4g65 published
- 2026-05-05: patched: Fixed in version 0.83.0
References
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65
- https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0
- https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc
- https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP
- https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule