CVE-2025-22620 — Improper Preservation of Permissions in Gitoxide

CWE-281 — Improper Preservation of PermissionsCWE-687 — Function Call With Incorrectly Specified Argument Value6 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.9%
top 23.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gitoxidelabs GitoxideDebian Rust-gix-worktree-state
Timeline
PublishedJan 20
Latest updateJan 21

Description

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NExploitability: 1.3 | Impact: 3.6

Affected Packages2 packages

▶debiandebian/rust-gix-worktree-state< rust-gix-worktree-state 0.11.1-2 (forky)
▶CVEListV5gitoxidelabs/gitoxide< 0.17.0

🔴Vulnerability Details

4
GHSA
gix-worktree-state nonexclusive checkout sets executable files world-writable↗2025-01-21
▶
OSV
gix-worktree-state nonexclusive checkout sets executable files world-writable↗2025-01-21
▶
OSV
CVE-2025-22620: gitoxide is an implementation of git written in Rust↗2025-01-20
▶
OSV
gix-worktree-state nonexclusive checkout sets executable files world-writable↗2025-01-18
▶

📋Vendor Advisories

1
Debian
CVE-2025-22620: rust-gix-worktree-state - gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-workt...↗2025
▶