World-Writable File Permissions in Gitoxide by GitoxideLabs

CVE-2025-22620

What is CVE-2025-22620?

Gitoxide, an implementation of git written in Rust, prior to version 0.17.0, has a vulnerability related to file permissions during the checkout process. Specifically, the gix-worktree-state component sets permissions to 0777 for executable files. Although the intention was for the umask to restrict these permissions, one of the approaches used to configure file permissions bypasses this restriction. Consequently, this can lead to scenarios where repository files become world-writable, posing a risk to the integrity and confidentiality of sensitive data. The issue has been addressed in version 0.17.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References