CVE-2025-22620: falha de média gravidade em GitoxideLabs gitoxide
gix-worktree-state nonexclusive checkout sets executable files world-writable
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.4%
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
GitoxideLabs · gitoxideCVEs relacionadas — GitoxideLabs gitoxide
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82253HIGHgitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassEPSS 0.7%CVE-2026-123532HIGHgix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC ProbeEPSS 0.6%CVE-2026-82252HIGHgitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesEPSS 0.5%CVE-2026-82251HIGHgitoxide before 0.52.1 Path Traversal via Submodule NameEPSS 0.5%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.5%CVE-2026-82250HIGHgitoxide gix-packetline before 0.21.5 Denial of ServiceEPSS 0.4%