Skip to content
OpenAdvisories
High ALAS2023-2026-2024 1 CVE

Important: rust-cargo-c security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 4, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40034: gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code execution.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 cargo-c 0:0.10.19-1.amzn2023.0.4
Amazon Linux · 2023 cargo-c-debuginfo 0:0.10.19-1.amzn2023.0.4
Amazon Linux · 2023 rust-cargo-c-debugsource 0:0.10.19-1.amzn2023.0.4

Vulnerabilities 1

  • High 7.8
    CVE-2026-40034

    gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

    gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partia…

    gitoxide gix-submodule gitoxide gix Debian Ubuntu Azure Linux Wolfi crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-40034.html