This vulnerability arises in the gix-submodule component of the gitoxide project, prior to version 0.82.0. The update field within a .gitmodules file is not properly validated, allowing an attacker to insert arbitrary shell commands. When Submodule::update() is invoked on a submodule that was initialized with only partial configuration stored in .git/config, the injected commands are executed. The result is remote code execution on any system that runs the vulnerable update routine.

The affected product is gitoxide, specifically its git submodule handling code before version 0.82.0. Users of older gitoxide releases that interact with submodules and rely on the .gitmodules update field must update to 0.82.0 or later, as earlier versions lack the validation guard.

The CVSS score of 7.3 indicates a high severity impact, and the vulnerability is listed as not present in the KEV catalog. The EPSS score is not available, so exploitation likelihood cannot be quantified. Based on the description, it is inferred that an attacker must gain the ability to modify a repository's .gitmodules file or otherwise influence the submodule configuration, then trigger Submodule::update(). Upon successful exploitation, arbitrary shell commands are executed with the privileges of the process performing the update. Therefore the risk profile is high for environments that automatically run submodule updates on untrusted repositories.