gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21558-1 advisory.

    Changes in gitoxide:

    - Update to 0.56.0:
      * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules         trust check could be bypassed in gix_submodule::File::update(),         which allowed arbitrary command execution from a crafted         .gitmodules file
      * Fixes a submodule name validation bypass that allowed traversal         out of .git/modules and disclosure of credentials
      * Fixes symlinked .gitmodules files being followed and parsed from         outside the repository
      * Fixes several denial-of-service vectors in gix-pack: unchecked         indexing panics and uncapped allocations from crafted pack data
      * Fixes HTTP credentials being leaked to the redirected host by the         curl transport backend
      * Add the gix config show, gix config list, gix config fmt,         gix free remote refs, gix free trust, gix dirwalk and gix tix         subcommands
      * Add a gix status --untracked flag and gix merge tree --message         for creating commits
      * gix exclude query is now index-aware and no longer reports ignore         matches for tracked files, matching git check-ignore
      * Preserve all configured remote URLs rather than only the last one
      * Fix fetching and cloning with tag refspecs in shallow clones,         relative worktree linking files and loose ref path-prefix         collisions
      * Update the crates to the Rust 2024 edition
    - Refresh the vendored dependencies. Recording the state of the       remaining open CVE bugs against this version, none of which it is       affected by:
      * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1,         above the 1.11.1 fix
      * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far         above the 0.17.0 that fixed the world-writable checkout of         executable files

    - update to 0.50.0:
      see https://github.com/GitoxideLabs/gitoxide/compare/v0.42.0...v0.50.0

    - update to 0.42.0:
      * add first 'debug' version of gix diff file
      * use revspecs for revision and path
      * CVE-2025-31130: use collision-detecting SHA-1 hash boo#1240872

    - Update to version 0.41.0:
      * add gix blame -L start,end
      * add gix env to print paths relevant to the Git installation.
      * Document the remaining subcommands
      * Add support for statistics and additional performance         information.
      * add gix blame to the CLI. That way it's possible to see the         blame result of any file in the repository.

    - Updates from version 0.40.0:
      * add first 'debug' version of gix log. It's primarily meant to         better understand gix blame.
      * add --tree-favor to gix merge tree|commit. With it one can         decide which side to favor in case of irreconcilable         tree-conflicts.
      * CVE-2025-22620: gix-worktree-state specifies 0777 permissions         when checking out executable files (boo#1236139)

    - Update to version 0.39.0:
      New Features
      * add gix merge commit --debug
      * add gix merge commits
      * add gix merge tree to merge trees similarly to git merge-tree.

    - Update to version 0.38.0:
      New Features
      * support for listing worktrees with gix worktree list
      * add first 'debug' version of gix diff tree.
      * add new gix cat command.
      * add gix merge-file with similar features as git merge-file
      * gix merge-base for the CLI       Bug Fixes
      * Adjust gix clean warning and help for worktree fix
      * Clarify -r/--repositories and --skip-hidden-repositories       Other
      * switch from time to jiff
      * Unify style in config support info

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2024 advisory.

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rust installed on the remote host is prior to 1.97.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3808 advisory.

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1951 advisory.

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21185-1 advisory.

    Changes in stgit:

    - Update to version 2.6.0:
      * chore: update changelog for 2.6.0
      * fix(import): respect --name verbatim, ignoring stgit.namelength
      * test(refresh): use test_when_finished for status.renames cleanup
      * expect over unwrap for test
      * bugfix: issue #615, add Copied variant to Status enum and move panic to a copied status, add     integration test
      * docs: Update copyright year
      * chore: update gix to 0.83 (CVE-2026-40034, bsc#1266429)
      * chore: update compatible transitive dependencies
      * chore: update winnow to 1.0.3
      * chore: update jiff to 0.2.24
      * ci: drop dead CARGO_TARGET_*_STRIP env vars from package build
      * ci: soft-pin cargo-deb to ^3.0
      * ci: bump cargo-generate-rpm pin to ^0.20.0
      * ci: bump GitHub Actions to Node 24 runtimes
      * chore: update winnow to 1.0.1
      * chore: update clap to 4.6.1
      * chore: update gix to 0.81
      * chore: bump MSRV to 1.85
      * chore: update transitive deps
      * chore: update winnow to 0.7.15
      * chore: update thiserror to 2.0.18
      * chore: update tempfile to 3.27.0
      * chore: update tar to 0.4.45
      * chore: update serde_json to 1.0.149
      * chore: update jiff to 0.2.23
      * chore: update indexmap to 2.14.0
      * chore: update flate2 to 1.1.9
      * chore: update ctrlc to 3.5.2
      * chore: update clap to 4.5.61
      * chore: update anyhow to 1.0.102
      * chore: update anstyle to 1.0.14

    - Update to version 2.5.5:
      * fix(squash): keep author when squashed commits have same author

    - Update to version 2.5.4:
      * chore: update changelog for 2.5.4
      * chore: update transitive dependencies
      * chore: update clap to 4.5.43
      * refactor: clippy fixes
      * fix: gix 0.73 breaking changes
      * chore: update gix to 0.73
      * chore: update transitive dependencies
      * chore: update serde_json to 1.0.142
      * chore: update winnow to 0.7.12
      * chore: update clap to 4.5.42
      * refactor: clippy lints
      * stgit.el: Use `with-eval-after-load' instead of a homemade version
      * stgit.el: Use `advice-add' instead of `defadvice'
      * stgit.el: Fix various checkdoc warnings
      * stgit.el: Support Emacs versions < 31
      * feat(bash): complete patches from chosen branch
      * chore: update dependencies
      * refactor: repair clippy lints
      * chore: update clap to 4.5.40
      * chore: update anstyle to 1.0.11
      * chore: update winnow to 0.7.11
      * chore: update anyhow to 1.0.98
      * chore: update jiff to 0.2.15
      * chore: update tempfile to 3.20.0
      * chore: update curl to 0.4.48
      * chore: update flate2 to 1.1.2
      * chore: update ctrlc to 3.4.7
      * chore(deps): bump winnow from 0.7.6 to 0.7.10
      * chore(deps): bump clap from 4.5.36 to 4.5.39
      * docs: Update copyright year
      * chore: update transitive dependencies
      * chore: update tempfile to 3.19.1
      * chore: update jiff to 0.2.6
      * chore: update winnow to 0.7.6
      * chore: update gix to 0.71
      * chore: update indexmap to 2.9.0
      * chore: update is-terminal to 0.4.16
      * chore: update ctrlc to 3.4.6
      * chore: update bstr to 1.12.0
      * chore: update clap to 4.5.36
      * chore: update flate2 to 1.1.1
      * chore: update serde to 1.0.219
      * chore: update serde_json to 1.0.140
      * chore: update thiserror to 2.0.12
      * chore: update anyhow to 1.0.97
      * refactor: repair clippy lint
      * stgit.el: Move 'stgit-patch-status-face-alist' before first use
      * stgit.el: Silence warnings of missing vc variables
      * stgit.el: Replace ad-hoc `make-local-variable' with `defvar-local'
      * stgit.el: Use defvar-local instead of make-local-variable
      * stgit.el: Enable lexical-binding
      * stgit.el: Allow empty descriptions
      * stgit.el: Add --no-color flag to 'git log' and 'git show'
      * stgit.el: Pass patch into `stgit-process-files'
      * chore: update changelog for 2.5.3
      * chore: update dependencies
      * refactor(stgit.el): use space-based indentation consistently
      * refactor: repair clippy lint
      * chore(deps): bump tempfile from 3.16.0 to 3.17.0
      * chore(deps): bump jiff from 0.2.0 to 0.2.1
      * build: statically linked packages for riscv64
      * chore: update changelog for 2.5.2
      * chore: update jiff to 0.2.0
      * chore: update winnow to 0.7.2
      * fix: partial_ref_name
      * chore: resolve winnow deprecations
      * chore: update dependencies
      * ci: disable test for windows build
      * chore(deps): bump jiff from 0.1.24 to 0.1.29
      * chore(deps): bump serde_json from 1.0.135 to 1.0.138
      * chore(deps): bump is-terminal from 0.4.13 to 0.4.15
      * chore(deps): bump indexmap from 2.7.0 to 2.7.1
      * chore(deps): bump clap from 4.5.26 to 4.5.28
      * stgit.el: Fix various compile warnings
      * stgit.el: Replace depercated cl function calls with new style
      * stgit.el: Fix some checkdoc warnings
      * stgit.el: Fix emacs pre-pending Summary:  to log-edit buffers
      * chore: update changelog for 2.5.1
      * chore: update release checklist
      * ci: use ubuntu-24.04 image
      * fix: assure branch creation respects fetch-specs of remotes. (#522)
      * chore: update to latest `gix` for improved API (#522)
      * chore: update transitive deps
      * chore: update anstyle-wincon to 3.0.7
      * chore: update bitflags to 2.8.0
      * chore: update jiff to 0.1.24
      * chore: update transitive deps
      * chore: update syn to 2.0.96
      * chore: update bitflags to 2.7.0
      * chore: update clap to 4.5.26
      * chore: update serde_json to 1.0.135
      * chore: update thiserror to 2.0.11
      * chore: update winnow to 0.6.24
      * refactor: repair clippy lints for is_some_and
      * test: repair regression with git v2.48
      * chore(deps): bump jiff from 0.1.18 to 0.1.21
      * chore(deps): bump bstr from 1.11.1 to 1.11.3
      * chore(deps): bump tempfile from 3.14.0 to 3.15.0
      * chore: update changelog for 2.5.0
      * chore: update transitive deps
      * chore: update windows-sys to 0.59.0
      * chore: update serde to 1.0.217
      * chore: update winnow to 0.6.21
      * chore: update jiff to 0.1.18
      * docs: explain stgit.autosign a bit better
      * feat: new name subcommand
      * feat: organize subcommands by group in help
      * chore: fix warning
      * feat: support calling stg rebase without arguments
      * tests: add test for rebase without arguments
      * chore: update dependencies
      * chore: update serde_json to 1.0.134
      * chore: update thiserror to 2.0.9
      * chore: update anyhow to 1.0.95
      * chore: update gix to 0.69
      * chore: update changelog for 2.4.13
      * chore: update transitive deps
      * chore: update jiff to 0.1.15
      * chore: update gix to 0.68
      * chore: update flate2 to 1.0.35
      * chore: update serde to 1.0.216
      * chore: update thiserror to 2.0.7
      * chore: update indexmap to 2.7.0
      * chore: update clap to 4.5.23
      * chore: update bstr to 1.11.1
      * chore: update anyhow to 1.0.94
      * refactor: repair clippy lints
      * chore: update thiserror to 2.0.3
      * chore: update allocator-api2 to 0.2.19
      * chore: update url to 2.5.3
      * chore: update cc to 1.1.37
      * chore: update anstream to 0.6.18
      * chore: update fastrand to 2.2.0
      * chore: update libc to 0.2.162
      * chore: update curl-sys to 0.4.78+curl-8.11.0
      * chore: update tempfile to 3.14.0
      * chore: update anyhow to 1.0.93
      * chore: update gix to 0.67.0
      * chore: update autocfg to 1.4.0
      * chore: update unicode-bidi to 0.3.17
      * chore: update unicode-ident to 1.0.13
      * chore: update redox_syscall to 0.5.7
      * chore: update colorchoice to 1.0.3
      * chore: update anstyle-query to 1.1.2
      * chore: update anstyle-parse to 0.2.6
      * chore: update proc-macro2 to 1.0.89
      * chore: update unicode-normalization to 0.1.24
      * chore: update gix-quote to 0.4.13
      * chore: update gix-bitmap to 0.2.12
      * chore: update gix-config-value to 0.14.9
      * chore: update memmap2 to 0.9.5
      * chore: update gix-chunk to 0.4.9
      * chore: update pkg-config to 0.3.31
      * chore: update cc to 1.1.34
      * chore: update anstream to 0.6.17
      * chore: update rustix to 0.38.38
      * chore: update once_cell to 1.20.2
      * chore: update gix-validate to 0.9.1
      * chore: update gix-utils to 0.1.13
      * chore: update gix-sec to 0.10.9
      * chore: update gix-date to 0.9.1
      * chore: update gix-command to 0.3.10
      * chore: update schannel to 0.1.26
      * chore: update openssl-sys to 0.9.104
      * chore: update libc to 0.2.161
      * chore: update regex-automata to 0.4.8
      * chore: update winnow to 0.6.20
      * chore: update thiserror to 1.0.67
      * chore: update tempfile to 3.13.0
      * chore: update tar to 0.4.43
      * chore: update serde_json to 1.0.132
      * chore: update serde to 1.0.214
      * chore: update jiff to 0.1.14
      * chore: update indexmap to 2.6.0
      * chore: update flate2 to 1.0.34
      * chore: update encoding_rs to 0.8.35
      * chore: update curl to 0.4.47
      * chore: update clap to 4.5.20
      * chore: update anyhow to 1.0.92
      * chore: update anstyle to 1.0.10

    - Update to 2.5.4
      * stgit.el: Use with-eval-after-load instead of a homemade version
      * stgit.el: Use advice-add instead of defadvice
      * stgit.el: Fix various checkdoc warnings
      * stgit.el: Support Emacs versions < 31
      * stgit.el: Move 'stgit-patch-status-face-alist' before first use
      * stgit.el: Silence warnings of missing vc variables
      * stgit.el: Replace ad-hoc make-local-variable with defvar-local
      * stgit.el: Use defvar-local instead of make-local-variable
      * stgit.el: Enable lexical-binding
      * stgit.el: Allow empty descriptions
      * stgit.el: Add --no-color flag to 'git log' and 'git show'
      * stgit.el: Pass patch into stgit-process-files
      * chore: update gix to 0.73
      * docs: Update copyright year
      * feat(bash): complete patches from chosen branch

    - Update to 2.5.3
      * build: statically linked packages for riscv64
      * chore: update dependencies
      * refactor(stgit.el): use space-based indentation consistently

    - Update to 2.5.2 2025-02-16
      * fix(stgit.el): various compile warnings
      * fix(stgit.el): Replace depercated cl function calls with new style
      * fix(stgit.el): checkdoc warnings
      * fix(stgit.el): emacs pre-pending Summary:  to log-edit buffers
      * chore: update jiff to 0.2.0
      * chore: update winnow to 0.7.2
      * chore: resolve winnow deprecations
      * chore: update dependencies

    - Update to 2.5.1 2025-01-18
      * fix: assure branch creation respects fetch-specs of remotes (#522)
      * ci: ubuntu-24.04 is now used to build release binaries
      * chore: gix is updated to 0.70

    - Update to 2.5.0 2025-01-01
      * feat: new name subcommand
      * feat: support calling stg rebase without arguments
      * docs: explain stgit.autosign a bit better
      * feat: organize subcommands by group in help

    - Update to 2.4.13
      * fix(squash): preserve consensus author
      * chore: update gix to 0.68

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update     field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a     submodule has been initialized with only partial configuration in .git/config. An attacker can inject     arbitrary shell commands via the update field in .gitmodules that will be executed when     Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.
    (CVE-2026-40034)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335081	openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21558-1)	Nessus	SuSE Local Security Checks	Local	high
331988	Amazon Linux 2023 : cargo-c (ALAS2023-2026-2024)	Nessus	Amazon Linux Local Security Checks	Local	high
328831	Amazon Linux 2 : rust, --advisory ALAS2-2026-3808 (ALAS-2026-3808)	Nessus	Amazon Linux Local Security Checks	Local	high
328502	Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-1951)	Nessus	Amazon Linux Local Security Checks	Local	high
324883	openSUSE 16: stgit / stgit-bash-completion / stgit-emacs / stgit-fish-completion / etc (openSUSE-SU-2026:21185-1)	Nessus	SuSE Local Security Checks	Local	high
317352	Linux Distros Unpatched Vulnerability : CVE-2026-40034	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-40034

high

Tenable Plugins

high

high

high

high

high

high