CVE-2026-40034

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

Summary

gix_submodule::File::update() is the API that gates whether an attacker-supplied .gitmodules file may set update = !<shell command>. The function is designed to return Err(CommandForbiddenInModulesConfiguration) unless the !command value came from a trusted local source (.git/config). Git CVE CVE-2019-19604 illustrates why this check is necessary.

However, the guard is implemented incorrectly: it checks whether any section with the same submodule name exists from a non-.gitmodules source; it does not verify that the update value came from that section.

Once a submodule has been initialized (any workflow that writes submodule.<name>.url to .git/config), and the attacker subsequently adds update = !cmd to .gitmodules, the guard passes while the command value falls through to the attacker-controlled file.

On an identical repository state, git submodule update aborts with fatal: invalid value for 'submodule.sub.update', while gix::Submodule::update() returns Ok(Some(Update::Command("touch /tmp/pwned"))).

The vulnerable code was introduced in https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0.

Details

The vulnerable method is gix_submodule::File::update: https://github.com/GitoxideLabs/gitoxide/blob/main/gix-submodule/src/access.rs#L168-L193:

pub fn update(&self, name: &BStr) -> Result<Option<Update>, config::update::Error> {
    let value: Update = match self.config.string(format!("submodule.{name}.update")) {
        //                    ^^^^^^^^^^^^^^^^^^
        //  [A] Reads the value. gix_config::File::string() iterates sections
        //      newest-to-oldest; if the override section lacks `update`, it
        //      falls through to .gitmodules and returns the attacker value.
        //
        // https://github.com/GitoxideLabs/gitoxide/blob/main/gix-config/src/file/access/raw.rs#L76
        Some(v) => v.as_ref().try_into().map_err(|()| config::update::Error::Invalid {
            submodule: name.to_owned(),
            actual: v.into_owned(),
        })?,
        None => return Ok(None),
    };

    if let Update::Command(cmd) = &value {
        let ours = self.config.meta();
        let has_value_from_foreign_section = self
            .config
            .sections_by_name("submodule")
            .into_iter()
            .flatten()
            .any(|s| s.header().subsection_name() == Some(name) && !std::ptr::eq(s.meta(), ours));
            //  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            //  [B] Checks only that SOME section with this name exists from a
            //      non-.gitmodules source. Does NOT check where [A]'s value
            //      came from.
        if !has_value_from_foreign_section {
            return Err(config::update::Error::CommandForbiddenInModulesConfiguration { ... });
        }
    }
    Ok(Some(value))
}

PoC

git submodule init copies submodule.$name.url and writes active = true into .git/config (init_submodule(), builtin/submodule--helper.c:438-517). It does not unconditionally copy update.

Since CVE-2019-19604, git rejects .gitmodules files that contain update = !cmd at parse time. However, init is a one-time operation - once the .git/config section exists, subsequent changes to .gitmodules are not re-inited.

So, the attack sequence is:

1. Attacker's repo ships a benign .gitmodules (no update key).
2. Victim clones and runs git submodule init -> .git/config contains:

   [submodule "sub"]
       active = true
       url = /tmp/sub-origin
   

3. Attacker pushes a new commit adding update = !cmd to .gitmodules.
4. Victim runs git pull -> .gitmodules now…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-f26g-jm89-4g65. This link is maintained to preserve external references.

Original Description

gix-submodule before 0.82.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

These are all security issues fixed in the stgit-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gitoxide-0.56.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the watchexec-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for stgit fixes the following issues:

Changes in stgit:

• Update to version 2.6.0:

  • chore: update changelog for 2.6.0
  • fix(import): respect --name verbatim, ignoring stgit.namelength
  • test(refresh): use test_when_finished for status.renames cleanup
  • expect over unwrap for test
  • bugfix: issue #615, add Copied variant to Status enum and move panic to a copied status, add integration test
  • docs: Update copyright year
  • chore: update gix to 0.83 (CVE-2026-40034, bsc#1266429)
  • chore: update compatible transitive dependencies
  • chore: update winnow to 1.0.3
  • chore: update jiff to 0.2.24
  • ci: drop dead CARGO_TARGET_*_STRIP env vars from package build
  • ci: soft-pin cargo-deb to ^3.0
  • ci: bump cargo-generate-rpm pin to ^0.20.0
  • ci: bump GitHub Actions to Node 24 runtimes
  • chore: update winnow to 1.0.1
  • chore: update clap to 4.6.1
  • chore: update gix to 0.81
  • chore: bump MSRV to 1.85
  • chore: update transitive deps
  • chore: update winnow to 0.7.15
  • chore: update thiserror to 2.0.18
  • chore: update tempfile to 3.27.0
  • chore: update tar to 0.4.45
  • chore: update serde_json to 1.0.149
  • chore: update jiff to 0.2.23
  • chore: update indexmap to 2.14.0
  • chore: update flate2 to 1.1.9
  • chore: update ctrlc to 3.5.2
  • chore: update clap to 4.5.61
  • chore: update anyhow to 1.0.102
  • chore: update anstyle to 1.0.14

• Update to version 2.5.5:

  • fix(squash): keep author when squashed commits have same author

• Update to version 2.5.4:

  • chore: update changelog for 2.5.4
  • chore: update transitive dependencies
  • chore: update clap to 4.5.43
  • refactor: clippy fixes
  • fix: gix 0.73 breaking changes
  • chore: update gix to 0.73
  • chore: update transitive dependencies
  • chore: update serde_json to 1.0.142
  • chore: update winnow to 0.7.12
  • chore: update clap to 4.5.42
  • refactor: clippy lints
  • stgit.el: Use `with-eval-after-load' instead of a homemade version
  • stgit.el: Use advice-add' instead of defadvice'
  • stgit.el: Fix various checkdoc warnings
  • stgit.el: Support Emacs versions < 31
  • feat(bash): complete patches from chosen branch
  • chore: update dependencies
  • refactor: repair clippy lints
  • chore: update clap to 4.5.40
  • chore: update anstyle to 1.0.11
  • chore: update winnow to 0.7.11
  • chore: update anyhow to 1.0.98
  • chore: update jiff to 0.2.15
  • chore: update tempfile to 3.20.0
  • chore: update curl to 0.4.48
  • chore: update flate2 to 1.1.2
  • chore: update ctrlc to 3.4.7
  • chore(deps): bump winnow from 0.7.6 to 0.7.10
  • chore(deps): bump clap from 4.5.36 to 4.5.39
  • docs: Update copyright year
  • chore: update transitive dependencies
  • chore: update tempfile to 3.19.1
  • chore: update jiff to 0.2.6
  • chore: update winnow to 0.7.6
  • chore: update gix to 0.71
  • chore: update indexmap to 2.9.0
  • chore: update is-terminal to 0.4.16
  • chore: update ctrlc to 3.4.6
  • chore: update bstr to 1.12.0
  • chore: update clap to 4.5.36
  • chore: update flate2 to 1.1.1
  • chore: update serde to 1.0.219
  • chore: update serde_json to 1.0.140
  • chore: update thiserror to 2.0.12
  • chore: update anyhow to 1.0.97
  • refactor: repair clippy lint
  • stgit.el: Move 'stgit-patch-status-face-alist' before first use
  • stgit.el: Silence warnings of missing vc variables
  • stgit.el: Replace ad-hoc make-local-variable' with defvar-local'
  • stgit.el: Use defvar-local instead of make-local-variable
  • stgit.el: Enable lexical-binding
  • stgit.el: Allow empty descriptions
  • stgit.el: Add "--no-color" flag to 'git log' and 'git show'
  • stgit.el: Pass patch into `stgit-process-files'
  • chore: update changelog for 2.5.3
  • chore: update dependencies
  • refactor(stgit.el): use space-based indentation consistently
  • refactor: repair clippy lint
  • chore(deps): bump tempfile from 3.16.0 to 3.17.0
  • chore(deps): bump jiff from 0.2.0 to 0.2.1
  • build: statically linked…

This update for gitoxide fixes the following issues:

Changes in gitoxide:

• Update to 0.56.0:

  • Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules trust check could be bypassed in gix_submodule::File::update(), which allowed arbitrary command execution from a crafted .gitmodules file
  • Fixes a submodule name validation bypass that allowed traversal out of .git/modules and disclosure of credentials
  • Fixes symlinked .gitmodules files being followed and parsed from outside the repository
  • Fixes several denial-of-service vectors in gix-pack: unchecked indexing panics and uncapped allocations from crafted pack data
  • Fixes HTTP credentials being leaked to the redirected host by the curl transport backend
  • Add the gix config show, gix config list, gix config fmt, gix free remote refs, gix free trust, gix dirwalk and gix tix subcommands
  • Add a gix status --untracked flag and gix merge tree --message for creating commits
  • gix exclude query is now index-aware and no longer reports ignore matches for tracked files, matching git check-ignore
  • Preserve all configured remote URLs rather than only the last one
  • Fix fetching and cloning with tag refspecs in shallow clones, relative worktree linking files and loose ref path-prefix collisions
  • Update the crates to the Rust 2024 edition

• Refresh the vendored dependencies. Recording the state of the remaining open CVE bugs against this version, none of which it is affected by:

  • CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1, above the 1.11.1 fix
  • CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far above the 0.17.0 that fixed the world-writable checkout of executable files

• update to 0.50.0: see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0

• update to 0.42.0:

  • add first 'debug' version of gix diff file
  • use revspecs for revision and path
  • CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872

• Update to version 0.41.0:

  • add gix blame -L start,end
  • add gix env to print paths relevant to the Git installation.
  • Document the remaining subcommands
  • Add support for statistics and additional performance information.
  • add gix blame to the CLI. That way it's possible to see the blame result of any file in the repository.

• Updates from version 0.40.0:

  • add first 'debug' version of gix log. It's primarily meant to better understand gix blame.
  • add --tree-favor to gix merge tree|commit. With it one can decide which side to favor in case of irreconcilable tree-conflicts.
  • CVE-2025-22620: gix-worktree-state specifies 0777 permissions when checking out executable files (boo#1236139)

• Update to version 0.39.0: New Features

  • add gix merge commit --debug
  • add gix merge commits
  • add gix merge tree to merge trees similarly to git merge-tree.

• Update to version 0.38.0: New Features

  • support for listing worktrees with gix worktree list
  • add first 'debug' version of gix diff tree.
  • add new gix cat command.
  • add gix merge-file with similar features as git merge-file
  • gix merge-base for the CLI Bug Fixes
  • Adjust gix clean warning and help for worktree fix
  • Clarify -r/--repositories and --skip-hidden-repositories Other
  • switch from time to jiff
  • Unify style in config support info