{"action":"Upgrade gix to 0.83.0 or later.","affected":[{"fixed":"0.83.0","introduced":"0.31.0"}],"component":"gix","cve_ids":["CVE-2026-40034"],"ecosystem":"crates.io","epss":0.00651,"exploited":false,"fixed_versions":["0.83.0"],"ghsa_id":"GHSA-f26g-jm89-4g65","id":"tcs_01M5KEX2WA7QMRQNTYT1S54JRZ","modified_at":"2026-09-10T03:51:05.286549483Z","published_at":"2026-05-05T19:23:45Z","references":["https://osv.dev/vulnerability/GHSA-f26g-jm89-4g65","https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65","https://nvd.nist.gov/vuln/detail/CVE-2026-40034","https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0","https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc","https://github.com/GitoxideLabs/gitoxide","https://red.anthropic.com/2026/cvd/findings/ANT-2026-6SNS6KMP","https://www.vulncheck.com/advisories/gitoxide-command-injection-via-partial-gitmodules-override-in-gix-submodule"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-f26g-jm89-4g65","url":"https://osv.dev/vulnerability/GHSA-f26g-jm89-4g65"}],"summary":"gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules"}