Security Flaw in Gitoxide Affecting Windows Users

CVE-2025-24890

What is CVE-2025-24890?

The gitoxide implementation in Rust contains a vulnerability affecting Windows environments prior to version 0.13.3. The gix-sec crate fails to authenticate user ownership correctly when an administrator runs a dependent program with an unfiltered elevated token. This allows repositories managed by a limited user to be accessed with elevated privileges, leading to potential execution of malicious repository configurations or hooks that can jeopardize system security. The issue specifically arises from the flawed checks in gix_sec::identity::is_path_owned_by_current_user, where directory ownership validation is bypassed. The exploitation requires specific user conditions and administrative access, making it a significant concern for affected users.

References