GHSA-f26g-jm89-4g65
High · 7.8CVSS
7.8
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | gix | 0.31.0 | 0.83.0 |
Related vulnerabilities
- GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects… Also affects gix
- GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the… Also affects gix
- GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal… Also affects gix
- CVE-2024-35186 gitoxide is a pure Rust implementation of Git. Also affects gix
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-183
- CVE-2026-54694 SkillTree is a micro-learning gamification platform. CWE-183
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-183
- CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through… CWE-183