gix-worktree-state nonexclusive checkout sets executable files world-writable

published 2025-01-18 21 mo ago modified 2026-11-09 6 h ago also EUVD-2025-0160 , GHSA-fqmf-w4xh-33rh , RUSTSEC-2025-0001

cvss: 5.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits: 0; none known

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

Patch / fix

fixed in 2 distros 2 links 1

crates.io gix-worktree-state 0.17.0
gitoxidelabs gix-worktree-state 0.17.0

debian opensuse

rust-gix-worktree-state Debian 14, Debian 13 0.11.1-2

debian advisories DEBIAN-CVE-2025-22620

gitoxide openSUSE Leap 16.0 0.56.0-bp160.1.1
gitoxide openSUSE Tumbleweed 0.42.0-1.1

opensuse advisories openSUSE-SU-2026:21558-1 openSUSE-SU-2025:14994-1

github.com/GitoxideLabs/gitoxide#1764 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-21)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.0	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
GitHub	3.1	5.0	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
OSV	3.1	5.0	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
crates.io	gix-worktree-state	<0.17.0 >=0.0.0-0, <0.17.0	0.17.0

Affected products

GitoxideLabs gitoxide

Classification

Weakness

CWE-281 Improper Preservation of Permissions
CWE-687 Function Call With Incorrectly Specified Argument Value

References

github.com /GitoxideLabs/gitoxide/pull/1764
web
github.com /GitoxideLabs/gitoxide/security/advisories/GHSA-fqmf-w4xh-33rh
web
nvd.nist.gov /vuln/detail/CVE-2025-22620
advisory, web
github.com /GitoxideLabs/gitoxide
package
rustsec.org /advisories/RUSTSEC-2025-0001.html
web, advisory
crates.io /crates/gix-worktree-state
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary