Vulnerability · Published Jan 20, 2025 · Assigned by GitHub_M

CVE-2025-22620gix-worktree-state nonexclusive checkout sets executable files world-writable

Medium 5.0

In plain English

A medium-severity security flaw in gitoxide from GitoxideLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.4%top 68.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rust-gix-worktree-state	0.11.1-2	DEBIAN-CVE-2025-22620
Debian:14	rust-gix-worktree-state	0.11.1-2	DEBIAN-CVE-2025-22620

Affected products (as reported)

Vendor	Product	Versions
GitoxideLabs	gitoxide	< 0.17.0

Weakness: CWE-281, CWE-687 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fqmf-w4xh-33rh x_refsource_CONFIRM