CVE-2025-22620CWE-281CWE-687

gix-worktree-state nonexclusive checkout sets executable files world-writable

Medium · published January 20, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.9th percentile
Weaknesses
CWE-281 · Improper Preservation of Permissions; CWE-687 · Function Call With Incorrectly Specified Argument Value
Published
2025-01-20T15:38Z
EPSS history
Timeline
  • 20 JAN 15:38Z
    gix-worktree-state nonexclusive checkout sets executable files world-writable
    cvelistv5