Description
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitoxideLabs | gitoxide | < 0.17.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-gix-worktree-state | 0.11.1-2 | — |
| Debian 13 | rust-gix-worktree-state | 0.11.1-2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gitoxide | 0.42.0-1.1 | openSUSE-SU-2025:14994-1 |
| openSUSE Leap 16.0 | gitoxide | 0.56.0-bp160.1.1 | openSUSE-SU-2026:21558-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cargo-audit | 0.21.2-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
EliahKagan/checkout-index ★ 0 · Jan 19, 2025
Reproducer for CVE-2025-22620
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | gix-worktree-state | < 0.17.0 | 0.17.0 | GHSA-fqmf-w4xh-33rh |
| crates.io | gix-worktree-state | >= 0.0.0-0, < 0.17.0 | 0.17.0 | RUSTSEC-2025-0001 |
Advisories 2
- openSUSE-SU-2026:21558-1 Security update for gitoxide SUSE / openSUSE Security Updates · Aug 12, 2026
- openSUSE-SU-2025:14994-1 gitoxide-0.42.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026