CVE-2026-40034: gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
Other sources
gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.75.0-30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.90.0-9 - Upgrade
Upgrade
gitoxideto a version that resolves this vulnerability.Fixed in 0.5.21 - Upgrade
Upgrade
gix-submoduleto a version that resolves this vulnerability.Fixed in 0.29.0 - Upgrade
Upgrade
gixto a version that resolves this vulnerability.Fixed in 0.84.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40034?
CVE-2026-40034 has a severity rating of high, with a score of 7.8.
How do I fix CVE-2026-40034?
To fix CVE-2026-40034, upgrade to gix-submodule version 0.82.0 or later.
What type of vulnerability is CVE-2026-40034?
CVE-2026-40034 is a command injection vulnerability.
What can an attacker achieve with CVE-2026-40034?
An attacker can inject arbitrary shell commands through a partial override in the .gitmodules configuration.
In which software is CVE-2026-40034 found?
CVE-2026-40034 is found in the gix-submodule software package.