Command Injection Vulnerability in gix-submodule by Gitoxide

CVE-2026-40034

What is CVE-2026-40034?

The gix-submodule component of Gitoxide, prior to version 0.82.0, fails to validate updates specified in the .gitmodules file. This flaw enables unauthorized users to bypass the CommandForbiddenInModulesConfiguration security measure. By manipulating the update field with partial configurations in .git/config, an attacker can inject and execute arbitrary shell commands when the Submodule::update() function is called. This could lead to remote execution of malicious code, posing a significant security risk to affected systems.

References