World-Writable File Permissions in Gitoxide by GitoxideLabs

CVE-2025-22620

What is CVE-2025-22620?

Gitoxide, an implementation of git written in Rust, prior to version 0.17.0, has a vulnerability related to file permissions during the checkout process. Specifically, the gix-worktree-state component sets permissions to 0777 for executable files. Although the intention was for the umask to restrict these permissions, one of the approaches used to configure file permissions bypasses this restriction. Consequently, this can lead to scenarios where repository files become world-writable, posing a risk to the integrity and confidentiality of sensitive data. The issue has been addressed in version 0.17.0.

References