CVE-2026-40034: Gitoxide gix-submodule command injection via .gitmodules bypass

CVE-2026-40034 · Severity: high · CVSS 7.8 · Published 2026-05-26

Gitoxide is a Rust implementation of the Git version control system. A security flaw in how it handles submodules allows a malicious repository to execute arbitrary commands on a user's computer. This occurs when a user interacts with a repository containing a specially crafted submodule configuration that bypasses security checks intended to prevent unauthorized command execution.

Technologies: gix (crates.io). Vendors: crates.io, GitoxideLabs.

Quick answers

Is CVE-2026-40034 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40034 being exploited in the wild.
How severe is CVE-2026-40034?
High severity, with a CVSS score of 7.8, published 26 May 2026.
Which products and versions are affected?
gix (crates.io) >= 0.31.0, < 0.83.0, SEMVER:introduced=0.31.0,fixed=0.83.0; GitoxideLabs Gix-Submodule < 0.82.0.
Is there a fix for CVE-2026-40034?
Yes. gix (crates.io): upgrade to 0.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40034 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40034?
Check whether you run gix (crates.io) or GitoxideLabs Gix-Submodule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gix (crates.io): upgrade to 0.83.0 or later
    cargo update -p gix

Technical details

A vulnerability exists in gix_submodule::File::update() where the security guard intended to prevent arbitrary command execution from .gitmodules is incorrectly implemented. The function checks if any trusted configuration section (like .git/config) exists for a submodule, but fails to verify that the specific 'update' command value actually originated from that trusted section. If a submodule is initialized (creating a trusted section for the URL), an attacker can later add a malicious 'update = !<command>' entry to the untrusted .gitmodules file. Gitoxide will incorrectly attribute the command to the trusted section's existence and return the attacker-controlled command for execution. This bypasses the protection established in response to CVE-2019-19604.

Affected products

  • GitoxideLabs gix >= 0.31.0, < 0.83.0

Identifiers

  • CVE-2026-40034
  • GHSA-f26g-jm89-4g65

Timeline

  • 2026-04-25: disclosed
  • 2026-05-05: advisory: GHSA-f26g-jm89-4g65 published
  • 2026-05-05: patched: Fixed in version 0.83.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.