https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:17:42.897000+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0753 certfr-2026-avi-0753 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer un p… 2026-10-04T15:17:42.905427+00:00 certfr-2026-avi-0753 https://cve.radiocsirt.org/vuln/euvd-2026-336765 EUVD-2026-336765 2026-10-04T15:17:42.905467+00:00 EUVD-2026-336765 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40034 fkie_cve-2026-40034 2026-10-04T15:17:42.905482+00:00

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

 https://cve.radiocsirt.org/vuln/ghsa-f26g-jm89-4g65 GHSA-f26g-jm89-4g65 — gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Exec… 2026-10-04T15:17:42.905510+00:00

Affected: crates.io: gix

### Summary

[`gix_submodule::File::update()`](https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168) is the API that gates whether an attacker-supplied `.gitmodules` file may set `update = !<shell command>`. The function is designed to return `Err(CommandForbiddenInModulesConfiguration)` unless the `!command` value came from a trusted local source (`.git/config`). Git CVE [CVE-2019-19604](https://nvd.nist.gov/vuln/detail/cve-2019-19604) illustrates why this check is necessary.

However, the guard is implemented incorrectly: it checks whether any section with the same submodule name exists from a non-`.gitmodules` source; it does not verify that the `update` value came from that section.

Once a submodule has been initialized (any workflow that writes `submodule.<name>.url` to `.git/config`), and the attacker subsequently adds `update = !cmd` to `.gitmodules`, the guard passes while the command value falls through to the attacker-controlled file.

On an identical repository state, `git submodule update` aborts with `fatal: invalid value for 'submodule.sub.update'`, while `gix::Submodule::update()` returns `Ok(Some(Update::Command("touch /tmp/pwned")))`.

The vulnerable code was introduced in https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0.

### Details

The vulnerable method is `gix_submodule::File::update`: https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168-L193:

```rust…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-40034 msrc_CVE-2026-40034 — gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule 2026-10-04T15:17:42.905589+00:00 msrc_CVE-2026-40034 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11038-1 openSUSE-SU-2026:11038-1 — stgit-2.6.0-1.1 on GA media 2026-10-04T15:17:42.905606+00:00

stgit-2.6.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40034 UBUNTU-CVE-2026-40034 2026-10-04T15:17:42.905621+00:00

Affected: Ubuntu:25.10: rust-gix, Ubuntu:25.10: rust-gix-submodule, Ubuntu:26.04:LTS: rust-gix, Ubuntu:26.04:LTS: rust-gix-submodule

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.