CVE-2026-40034 gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule
Attackers can execute arbitrary shell commands via malicious .gitmodules configuration in gix-submodule, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40034?
CVE-2026-40034 is a high-severity command injection vulnerability in gitoxide, published on 26 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
Weakness: CWE-77
Which versions are affected by CVE-2026-40034?
2 open source packages ship an affected version, including gix.
| Package | Affected | Fixed in |
|---|---|---|
gix crates.io | From 0.31.0 | 0.83.0 |
gix crates.io | From 0.31.0 | 0.83.0 |
Linux distribution packages (3)
stgit openSUSE:Leap 16.0 | All versions | 2.6.0-bp160.1.1 |
stgit openSUSE:Tumbleweed | All versions | 2.6.0-1.1 |
watchexec openSUSE:Tumbleweed | All versions | 2.8.0-1.1 |
How do I fix CVE-2026-40034?
Upgrade gix to 0.83.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-40034 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40034 exists.
Sources
Also known as AZL-89292, AZL-89295, DEBIAN-CVE-2026-40034, GHSA-f26g-jm89-4g65, MINI-q664-jrjx-6mhj, UBUNTU-CVE-2026-40034 and 3 more.