https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 17:43:18 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0753 certfr-2026-avi-0753 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0753 https://cve.radiocsirt.org/vuln/euvd-2026-336765 EUVD-2026-336765 https://cve.radiocsirt.org/vuln/euvd-2026-336765 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40034 <p>gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.</p> <p>gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40034 https://cve.radiocsirt.org/vuln/ghsa-f26g-jm89-4g65 <p><strong>Affected:</strong> crates.io: gix</p> <p>### Summary</p> <p>[`gix_submodule::File::update()`](https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168) is the API that gates whether an attacker-supplied `.gitmodules` file may set `update = !&lt;shell command&gt;`. The function is designed to return `Err(CommandForbiddenInModulesConfiguration)` unless the `!command` value came from a trusted local source (`.git/config`). Git CVE [CVE-2019-19604](https://nvd.nist.gov/vuln/detail/cve-2019-19604) illustrates why this check is necessary.</p> <p>However, the guard is implemented incorrectly: it checks whether any section with the same submodule name exists from a non-`.gitmodules` source; it does not verify that the `update` value came from that section.</p> <p>Once a submodule has been initialized (any workflow that writes `submodule.&lt;name&gt;.url` to `.git/config`), and the attacker subsequently adds `update = !cmd` to `.gitmodules`, the guard passes while the command value falls through to the attacker-controlled file.</p> <p>On an identical repository state, `git submodule update` aborts with `fatal: invalid value for &#39;submodule.sub.update&#39;`, while `gix::Submodule::update()` returns `Ok(Some(Update::Command(&#34;touch /tmp/pwned&#34;)))`.</p> <p>The vulnerable code was introduced in https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0.</p> <p>### Details</p> <p>The vulnerable method is `gix_submodule::File::update`: https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168-L193:</p> <p>```rust…</p> <p><strong>Affected:</strong> crates.io: gix</p> <p>### Summary</p> <p>[`gix_submodule::File::update()`](https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168) is the API that gates whether an attacker-supplied `.gitmodules` file may set `update = !&lt;shell command&gt;`. The function is designed to return `Err(CommandForbiddenInModulesConfiguration)` unless the `!command` value came from a trusted local source (`.git/config`). Git CVE [CVE-2019-19604](https://nvd.nist.gov/vuln/detail/cve-2019-19604) illustrates why this check is necessary.</p> <p>However, the guard is implemented incorrectly: it checks whether any section with the same submodule name exists from a non-`.gitmodules` source; it does not verify that the `update` value came from that section.</p> <p>Once a submodule has been initialized (any workflow that writes `submodule.&lt;name&gt;.url` to `.git/config`), and the attacker subsequently adds `update = !cmd` to `.gitmodules`, the guard passes while the command value falls through to the attacker-controlled file.</p> <p>On an identical repository state, `git submodule update` aborts with `fatal: invalid value for &#39;submodule.sub.update&#39;`, while `gix::Submodule::update()` returns `Ok(Some(Update::Command(&#34;touch /tmp/pwned&#34;)))`.</p> <p>The vulnerable code was introduced in https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0.</p> <p>### Details</p> <p>The vulnerable method is `gix_submodule::File::update`: https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168-L193:</p> <p>```rust…</p> https://cve.radiocsirt.org/vuln/ghsa-f26g-jm89-4g65 https://cve.radiocsirt.org/vuln/msrc_cve-2026-40034 msrc_CVE-2026-40034 https://cve.radiocsirt.org/vuln/msrc_cve-2026-40034 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11038-1 <p>stgit-2.6.0-1.1 on GA media</p> <p>stgit-2.6.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11038-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40034 <p><strong>Affected:</strong> Ubuntu:25.10: rust-gix, Ubuntu:25.10: rust-gix-submodule, Ubuntu:26.04:LTS: rust-gix, Ubuntu:26.04:LTS: rust-gix-submodule</p> <p>gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.</p> <p><strong>Affected:</strong> Ubuntu:25.10: rust-gix, Ubuntu:25.10: rust-gix-submodule, Ubuntu:26.04:LTS: rust-gix, Ubuntu:26.04:LTS: rust-gix-submodule</p> <p>gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40034