GitoxideLabs gitoxide up to 0.16.x Executable File permissions

Summaryinfo

A vulnerability labeled as critical has been found in GitoxideLabs gitoxide up to 0.16.x. This affects an unknown part of the component Executable File Handler. Executing a manipulation can lead to permissions. The identification of this vulnerability is CVE-2025-22620. The attack can only be executed locally. Furthermore, there is an exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in GitoxideLabs gitoxide up to 0.16.x. It has been declared as critical. This vulnerability affects an unknown part of the component Executable File Handler. The manipulation with an unknown input leads to a permissions vulnerability. The CWE definition for the vulnerability is CWE-281. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-22620 since 01/07/2025. The exploitation appears to be easy. The attack needs to be approached locally. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1222.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Upgrading to version 0.17.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• GitoxideLabs

Name

• gitoxide

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16

Website

• Product: https://github.com/GitoxideLabs/gitoxide/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion