# CVE-2026-40034: Gitoxide gix-submodule command injection via .gitmodules bypass

Source: https://junglewise.ai/threats/cve-2026-40034-gitoxide-gix-submodule-command-injection-via-gitmodules-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40034 · Severity: high · CVSS 7.8 · Published 2026-05-26

Gitoxide is a Rust implementation of the Git version control system. A security flaw in how it handles submodules allows a malicious repository to execute arbitrary commands on a user's computer. This occurs when a user interacts with a repository containing a specially crafted submodule configuration that bypasses security checks intended to prevent unauthorized command execution.

Technologies: [gix (crates.io)](https://junglewise.ai/threats/technologies/gix). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [GitoxideLabs](https://junglewise.ai/threats/vendors/gitoxidelabs).

## Quick answers

**Is CVE-2026-40034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40034 being exploited in the wild.

**How severe is CVE-2026-40034?** High severity, with a CVSS score of 7.8, published 26 May 2026.

**Which products and versions are affected?** gix (crates.io) >= 0.31.0, < 0.83.0, SEMVER:introduced=0.31.0,fixed=0.83.0; GitoxideLabs Gix-Submodule < 0.82.0.

**Is there a fix for CVE-2026-40034?** Yes. gix (crates.io): upgrade to 0.83.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40034 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40034?** Check whether you run gix (crates.io) or GitoxideLabs Gix-Submodule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gix (crates.io): upgrade to 0.83.0 or later

  ```sh
  cargo update -p gix
  ```


## Technical details

A vulnerability exists in gix_submodule::File::update() where the security guard intended to prevent arbitrary command execution from .gitmodules is incorrectly implemented. The function checks if any trusted configuration section (like .git/config) exists for a submodule, but fails to verify that the specific 'update' command value actually originated from that trusted section. If a submodule is initialized (creating a trusted section for the URL), an attacker can later add a malicious 'update = !<command>' entry to the untrusted .gitmodules file. Gitoxide will incorrectly attribute the command to the trusted section's existence and return the attacker-controlled command for execution. This bypasses the protection established in response to CVE-2019-19604.

## Affected products

- GitoxideLabs gix >= 0.31.0, < 0.83.0

## Identifiers

- CVE-2026-40034
- GHSA-f26g-jm89-4g65

## Timeline

- 2026-04-25: disclosed
- 2026-05-05: advisory: GHSA-f26g-jm89-4g65 published
- 2026-05-05: patched: Fixed in version 0.83.0

## References

- [https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65](https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65)
- [https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0](https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0)
- [https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc](https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc)
- [https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP](https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP)
- [https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule](https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule)

## Related threats

- [gitoxide gix path-protection bypass via untrusted .git/config](https://junglewise.ai/threats/gitoxide-gix-untrusted-git-config-disables-filesystem-git-protection-1eddd4d0)
- [gitoxide path traversal in submodule name validation](https://junglewise.ai/threats/cve-2026-82253-gitoxide-path-traversal-in-submodule-name-validation)
- [gitoxide symlink following in .gitmodules file](https://junglewise.ai/threats/cve-2026-82252-gitoxide-symlink-following-in-gitmodules-file)
- [gitoxide path traversal in submodule name resolution](https://junglewise.ai/threats/cve-2026-82251-gitoxide-path-traversal-in-submodule-name-resolution)
- [gitoxide gix-submodule command injection in gix_submodule::File::update](https://junglewise.ai/threats/gitoxide-gix-submodule-command-injection-in-gix-submodule-file-update-5009257f)