The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade rust-analyzerUpgrade rust-debugger-commonUpgrade rust-docUpgrade clippyUpgrade rust-toolsetUpgrade rust-gdbUpgrade rust-std-staticUpgrade rustUpgrade rust-srcUpgrade cargoUpgrade rust-toolset-srpm-macrosUpgrade rustfmt | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade rustfmt-debuginfoUpgrade rust-std-static-wasm32-wasip1Upgrade rust-analyzer-debuginfoUpgrade rust-debuginfoUpgrade rustfmtUpgrade rust-debugger-commonUpgrade rust-srcUpgrade rustUpgrade cargo-cUpgrade rust-docUpgrade rust-lldbUpgrade cargo-c-debuginfoUpgrade rust-std-staticUpgrade rust-debugsourceUpgrade clippyUpgrade rust-gdbUpgrade clippy-debuginfoUpgrade rust-analyzerUpgrade cargo-debuginfoUpgrade cargoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-toolset-srpm-macrosUpgrade rust-toolsetUpgrade rust-cargo-c-debugsource | Jul 21, 2026 | May 26, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub