gix-sec safe.directory protections absent for elevated administrators
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator's privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GitoxideLabs | gitoxide | before 0.13.3 | 0.13.3 | Patch available | CNA |
| — | gix-sec (crates.io) | before 0.13.3 | 0.13.3 | Patch available | GHSA-7rhf-42qf-vrvc |
- gitoxide VendorGitoxideLabs Affected before 0.13.3 Fixed in 0.13.3 Patch available CNA
- gix-sec (crates.io) Vendor— Affected before 0.13.3 Fixed in 0.13.3 Patch available GHSA-7rhf-42qf-vrvc
Remediation
- Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.13.3
- Fix · GHSA-7rhf-42qf-vrvc gix-sec (crates.io) Fixed in 0.13.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24890
- 2026-10-03 Alias added: GHSA-7rhf-42qf-vrvc
References
Other 6
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc
- https://github.com/GitoxideLabs/gitoxide/pull/2510
- https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559
- https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3
- https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f
- https://github.com/GitoxideLabs/gitoxide
More GitoxideLabs vulnerabilities
- TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
- TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
- TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
- TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
- TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
- TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
Sources
- CVE-2025-24890 · CVE Program
- CVE-2025-24890 · NVD
- FIRST EPSS
- GHSA-7rhf-42qf-vrvc · GitHub Advisory Database · CC BY 4.0
- CVE-2025-24890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences