gix-worktree-state nonexclusive checkout sets executable files world-writable
Summary
gix-worktree-state nonexclusive checkout sets executable files world-writable
Original description
The description as published by the source.
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-22620 rust-gix-worktree-state Fixed in: 0.11.1-2
References
- advisory rustsec.org
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- advisory github.com
- package crates.io
- web github.com