gitoxide gix-submodule command injection in gix_submodule::File::update

Severity: high · CVSS 7.8 · Published 2026-05-26

Executive brief

A vulnerability in the gitoxide Rust library could allow an attacker to execute malicious commands on a user's system. This occurs when a user interacts with a specially crafted Git repository containing a malicious submodule configuration. If exploited, this could lead to full system compromise, data theft, or unauthorized access to the user's environment.

Technical details

A command injection vulnerability exists in gix-submodule due to an incorrect validation logic in the CommandForbiddenInModulesConfiguration guard. The `gix_submodule::File::update()` function fails to verify that a submodule's 'update' command originates from a trusted local configuration (.git/config) rather than the attacker-controlled .gitmodules file. If a submodule is partially initialized in the local config, the guard is disarmed, allowing the library to execute arbitrary shell commands defined in the .gitmodules file when Submodule::update() is called. This bypasses the security mechanism intended to prevent remote code execution from untrusted repository metadata. The issue is addressed in version 0.83.0.

Affected products

gitoxide gix-submodule >= 0.31.0, < 0.83.0
gitoxide gix >= 0.31.0, < 0.83.0

Timeline

2026-04-25: advisory: Original advisory GHSA-f26g-jm89-4g65 published by maintainer
2026-05-26: disclosed: NVD publication of CVE-2026-40034
2026-06-30: other: Duplicate advisory GHSA-m4f9-c775-wg56 withdrawn

References

Related threats

Gitoxide gix-submodule command injection via .gitmodules bypass