CVE-2025-22620 - CVE House
Back to Database
Status published Medium CVE-2025-22620

gix-worktree-state nonexclusive checkout sets executable files world-writable

Vulnerability Description

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22620

Credits & Attribution

No credits recorded in the NVD database.

References

More from GitoxideLabs

View All →
CVE-2025-31130
gitoxide does not detect SHA-1 collision attacks
Medium 6.8
CVE-2023-53158
The gix-transport crate before 0.36.1 for Rust allows command execution...
Medium 4.1

Affected Vendor

GitoxideLabs

View all reports →

Affected Software

gitoxide
Vulnerable Versions:
< 0.17.0

Timeline

Official Publish: January 20th, 2025
Last Modified: January 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-281 CWE-687

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.