gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
CVSS Details
- CVSS 4.0 Base Score: 8.5 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade rust-toolsetUpgrade rust-debugger-commonUpgrade rust-std-staticUpgrade rust-docUpgrade rust-gdbUpgrade rustUpgrade clippyUpgrade rust-srcUpgrade cargoUpgrade rust-analyzerUpgrade rust-toolset-srpm-macrosUpgrade rustfmt | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade rust-std-staticUpgrade rust-debuginfoUpgrade rust-lldbUpgrade rust-srcUpgrade rust-docUpgrade rustUpgrade rustfmt-debuginfoUpgrade rust-analyzer-debuginfoUpgrade cargo-c-debuginfoUpgrade rust-debugger-commonUpgrade cargo-cUpgrade rustfmtUpgrade rust-std-static-wasm32-wasip1Upgrade cargo-debuginfoUpgrade rust-cargo-c-debugsourceUpgrade rust-toolsetUpgrade rust-toolset-srpm-macrosUpgrade cargoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-gdbUpgrade rust-debugsourceUpgrade clippy-debuginfoUpgrade rust-analyzerUpgrade clippy | Jul 21, 2026 | May 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub