Read the docs
TI-2026-28877 Aliases CVE-2026-40034GHSA-f26g-jm89-4g65

gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

Priority HIGH 67CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00651 51st percentileScored 2026-11-07
Fix Fixed gitoxide (gitoxide): 0.5.21gix-submodule (gitoxide): 0.29.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitoxidegitoxidebefore 0.5.210.5.21Patch availableCNA
gitoxidegix-submodulebefore 0.29.00.29.0Patch availableCNA
gitoxidegixbefore 0.84.00.84.0Patch availableCNA
—gix (crates.io)0.31.0 to before 0.83.00.83.0Patch availableGHSA-f26g-jm89-4g65
  • gitoxide Vendorgitoxide Affected before 0.5.21 Fixed in 0.5.21 Patch available CNA
  • gix-submodule Vendorgitoxide Affected before 0.29.0 Fixed in 0.29.0 Patch available CNA
  • gix Vendorgitoxide Affected before 0.84.0 Fixed in 0.84.0 Patch available CNA
  • gix (crates.io) Vendor— Affected 0.31.0 to before 0.83.0 Fixed in 0.83.0 Patch available GHSA-f26g-jm89-4g65

Remediation

  • Fix · CNA gitoxide (gitoxide) Fixed in 0.5.21
  • Fix · CNA gix-submodule (gitoxide) Fixed in 0.29.0
  • Fix · CNA gix (gitoxide) Fixed in 0.84.0
  • Fix · GHSA-f26g-jm89-4g65 gix (crates.io) Fixed in 0.83.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40034
  2. 2026-10-03 Alias added: GHSA-f26g-jm89-4g65
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences