Description
gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
Problem types
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Product status
Any version before 0.5.21
0.5.21 (semver)
Any version before 0.29.0
0.29.0 (semver)
Any version before 0.84.0
0.84.0 (semver)
References
github.com/...toxide/security/advisories/GHSA-f26g-jm89-4g65
github.com/...toxide/security/advisories/GHSA-f26g-jm89-4g65 (GHSA Advisory GHSA-f26g-jm89-4g65)
github.com/...ommit/6a2e6a436f76c8bbf2487f9967413a51356667a0
github.com/...ommit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc
red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP (Anthropic CVD Finding ANT-2026-6SNS6KMP)
www.vulncheck.com/...al-gitmodules-override-in-gix-submodule (VulnCheck Advisory: gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule)