{"id":"CVE-2026-40034","summary":"gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule","details":"gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.","aliases":["GHSA-f26g-jm89-4g65"],"modified":"2026-11-12T03:50:08.568690691Z","published":"2026-05-26T14:08:48.264Z","related":["openSUSE-SU-2026:11038-1","openSUSE-SU-2026:11474-1","openSUSE-SU-2026:12338-1","openSUSE-SU-2026:21185-1","openSUSE-SU-2026:21558-1"],"database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40034.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"fixed":"0.5.21"},{"fixed":"0.84.0"}]}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40034.json"},{"type":"ADVISORY","url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40034"},{"type":"ADVISORY","url":"https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule"},{"type":"FIX","url":"https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0"},{"type":"FIX","url":"https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gitoxidelabs/gitoxide","events":[{"introduced":"0"},{"fixed":"6c62e748240ac0980fc23fdf30f8477dea8b9bc3"},{"fixed":"6a2e6a436f76c8bbf2487f9967413a51356667a0"},{"fixed":"dd5c18d9e526e8de462fa40aa047acd097cfa7dc"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"0.29.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"6a2e6a436f76c8bbf2487f9967413a51356667a0"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"dd5c18d9e526e8de462fa40aa047acd097cfa7dc"}]}]}}],"versions":["v0.47.0","v0.37.0","v0.36.0","v0.35.0","v0.34.0","v0.33.0","v0.31.1","v0.31.0","v0.30.0","v0.28.0","cargo-smart-release-v0.20.0","v0.27.0","TEST-0.0.0","v0.26.0","v0.25.0","cargo-smart-release-v0.19.0","cargo-smart-release-v0.18.0","v0.24.0","v0.23.0","cargo-smart-release-v0.17.0","v0.22.1","cargo-smart-release-v0.16.1","v0.22.0","cargo-smart-release-v0.16.0","v0.21.0","cargo-smart-release-v0.15.0","v0.20.0","v0.19.0","v0.18.0","cargo-smart-release-v0.14.0","v0.17.0","cargo-smart-release-v0.13.0","cargo-smart-release-v0.12.1","cargo-smart-release-v0.12.0","v0.14.0","v0.13.0","cargo-smart-release-v0.10.2","cargo-smart-release-v0.10.1","cargo-smart-release-v0.10.0","v0.12.0","v0.11.0","cargo-smart-release-v0.9.0","cargo-smart-release-v0.8.0","cargo-smart-release-v0.7.0","cargo-smart-release-v0.6.0","cargo-smart-release-v0.5.6","cargo-smart-release-v0.5.5","cargo-smart-release-v0.5.4","cargo-smart-release-v0.5.3","v0.10.0","cargo-smart-release-v0.5.2","cargo-smart-release-v0.5.1","cargo-smart-release-v0.5.0","v0.9.0","cargo-smart-release-v0.4.0","v0.8.4","cargo-smart-release-v0.3.1","v0.8.3","cargo-smart-release-v0.3.0","v0.8.2","cargo-smart-release-v0.2.4","cargo-smart-release-v0.2.3","cargo-smart-release-v0.2.2","v0.8.1","gitoxide-v0.8.1","gitoxide-v0.8.0","cargo-smart-release-v0.2.1","cargo-smart-release-v0.2.0","cargo-smart-release-v0.1.0","v0.7.0","end-2020","v0.6.0","v0.5.0","v0.4.0","v0.3.0","v0.1.0","the-beginning-2020"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40034.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}