https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:00:58.564924+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-40034 CVE-2026-40034 — gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule 2026-10-06T11:00:58.579645+00:00

Affected: gitoxide, gitoxide gix-submodule, gitoxide gix

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.