PT-2026-43251 · Unknown+2 · Gix-Submodule+2

Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-40034

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gix-submodule versions prior to 0.29.0 gitoxide versions prior to 0.5.21 gix versions prior to 0.84.0

Description Incorrect validation of the update field in .gitmodules allows attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule is initialized with only partial configuration in .git/config. This enables remote code execution by injecting arbitrary shell commands via the update field, which are executed when the Submodule::update() function is called on a previously initialized submodule.

Recommendations Update gix-submodule to version 0.29.0 or later. Update gitoxide to version 0.5.21 or later. Update gix to version 0.84.0 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-40034

Affected Products

Gitoxide

Gix

Gix-Submodule

References · 7

• 🔥 https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65 · Exploit
• https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0 · Patch
• https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40034 · Security Note
• https://vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule · Note
• https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP · Note
• https://t.me/CVEtracker/54985 · Telegram Post