This vulnerability arises in the gix-submodule component of the gitoxide project, prior to version 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0). The update field within a .gitmodules file is not properly validated, allowing attackers to insert arbitrary shell commands and bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. When Submodule::update() is called on a previously–initialized submodule, the injected commands are executed. The result is remote code execution on any system that runs the vulnerable update routine.

The affected products are gitoxide, gix, and gix-submodule. Versions of gitoxide before 0.5.21, gix before 0.84.0, and gix-submodule before 0.29.0 incorrectly validate the update field. Users of older releases that interact with submodules and rely on the .gitmodules update field must update to versions 0.5.21, 0.84.0, or 0.29.0 or later respectively.

The CVSS score of 7.3 indicates a high severity impact, and the vulnerability is listed as not present in the KEV catalog. The EPSS score of 0.00017 indicates a very low exploitation probability. Based on the description, it is inferred that an attacker must gain the ability to modify a repository's .gitmodules file or otherwise influence the submodule configuration, then trigger Submodule::update(). Upon successful exploitation, arbitrary shell commands are executed with the privileges of the process performing the update. Therefore the risk profile is high for environments that automatically run submodule updates on untrusted repositories.