CVE catalog

CVE-2025-22620

UBUNTU-CVE-2025-22620

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-gix-worktree-state130.11.1-2fixed
Debianrust-gix-worktree-state140.11.1-2fixed
Opensusegitoxidetumbleweed0.42.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-gix-worktree-statedeb130.11.1-2Not reportedDEBIAN-CVE-2025-22620Not reported
Debianrust-gix-worktree-statedeb140.11.1-2Not reportedDEBIAN-CVE-2025-22620Not reported
Opensusegitoxiderpmtumbleweed0.42.0-1.1Not reportedOPENSUSE-SU-2025:14994-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-gix-worktree-state-dev]Fixed

    Source package: [rust-gix-worktree-state]

    Details (2)

    • 0.16.0-1 · amd64 · trixie

      Fixed · Fixed: 0.11.1-2

      pypi · rust-gix-worktree-state · debian · 13

    • 0.16.0-1 · arm64 · trixie

      Fixed · Fixed: 0.11.1-2

      pypi · rust-gix-worktree-state · debian · 13

[openSUSE Tumbleweed]

  • [gitoxide]Fixed

    Source package: [gitoxide]

    Details (1)

    • 0.58.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.42.0-1.1

      pypi · gitoxide · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]