CVE-2025-22620 gix-worktree-state nonexclusive checkout sets executable files world-writable
An attacker with local access can modify world-writable executable files checked out by gitoxide, potentially leading to unauthorized code execution or data tampering.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-22620?
CVE-2025-22620 is a medium-severity vulnerability in GitoxideLabs gitoxide, published on 20 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
Which versions are affected by CVE-2025-22620?
3 open source packages ship an affected version, including gix-worktree-state.
| Package | Affected | Fixed in |
|---|---|---|
gix-worktree-state crates.io | All versions | 0.17.0 |
gix-worktree-state crates.io | All versions | 0.17.0 |
gix-worktree-state crates.io | From 0.0.0-0 | 0.17.0 |
How do I fix CVE-2025-22620?
Upgrade gix-worktree-state to 0.17.0 or later.
Is CVE-2025-22620 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-22620 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2025-22620, GHSA-fqmf-w4xh-33rh, RUSTSEC-2025-0001.