Vulnerability-Lookup

CVE-2025-24890 (GCVE-0-2025-24890)

Vulnerability from cvelistv5 – Published: 2026-09-14 15:28 – Updated: 2026-09-14 19:00

Title

gix-sec safe.directory protections absent for elevated administrators

Summary

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator's privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 19:00 UTC

CWE

CWE-283 - Unverified Ownership

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8024 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	x_refsource_CONFIRM
https://github.com/GitoxideLabs/gitoxide/pull/2510	x_refsource_MISC
https://github.com/GitoxideLabs/gitoxide/commit/3…	x_refsource_MISC
https://github.com/GitoxideLabs/gitoxide/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
GitoxideLabs	gitoxide	Affected: < 0.13.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:00:48.323079Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T19:00:54.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator\u0027s privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-283",
              "description": "CWE-283: Unverified Ownership",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T15:28:03.220Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
        },
        {
          "name": "https://github.com/GitoxideLabs/gitoxide/pull/2510",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/pull/2510"
        },
        {
          "name": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559"
        },
        {
          "name": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3"
        }
      ],
      "source": {
        "advisory": "GHSA-7rhf-42qf-vrvc",
        "discovery": "UNKNOWN"
      },
      "title": "gix-sec safe.directory protections absent for elevated administrators"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-24890",
    "datePublished": "2026-09-14T15:28:03.220Z",
    "dateReserved": "2025-01-27T15:32:29.450Z",
    "dateUpdated": "2026-09-14T19:00:54.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-24890",
      "date": "2026-10-30",
      "epss": "0.00165",
      "percentile": "0.05684"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:45:26.000Z",
      "cve": "CVE-2025-24890",
      "id": "msrc_CVE-2025-24890",
      "initial_release_date": "2026-09-15T01:08:08.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "gix-sec safe.directory protections absent for elevated administrators",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-24890.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "gitoxide",
                "vendor": "GitoxideLabs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.13.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator\u0027s privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3."
          },
          {
            "lang": "es",
            "value": "gitoxide es una implementaci\u00f3n de git escrita en Rust. Versiones anteriores a la 0.13.3, el crate gix-sec en Windows trata incorrectamente los repositorios controlados por otro usuario como de confianza cuando un administrador ejecuta un programa dependiente con un token elevado sin filtrar. En gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtiene folder_owner y token_owner, pero sus comprobaciones IsWellKnownSid y CheckTokenMembership espec\u00edficas del administrador examinan el token en ejecuci\u00f3n en lugar de confirmar el propietario del directorio. Esto elude la protecci\u00f3n de estilo safe.directory para repositorios propiedad y configurados por un usuario limitado, permitiendo que la configuraci\u00f3n del repositorio o los hooks ejecuten comandos con los privilegios del administrador cuando se realiza una operaci\u00f3n afectada. La explotaci\u00f3n requiere Windows, un administrador con privilegios elevados, un programa que dependa de los resultados de confianza de gix-sec y la interacci\u00f3n con un repositorio controlado por otro usuario. Un proceso UAC sin elevaci\u00f3n no se ve afectado, y la clonaci\u00f3n tampoco se ve afectada porque la configuraci\u00f3n del repositorio y los hooks no se copian. Este problema se ha solucionado en la versi\u00f3n 0.13.3."
          }
        ],
        "id": "CVE-2025-24890",
        "lastModified": "2026-10-14T19:10:00.297",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 5.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-24890",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:00:48.323079Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T16:17:05.117",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/GitoxideLabs/gitoxide/pull/2510"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-283"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T12:13:46+00:00",
      "cve": "CVE-2025-24890",
      "id": "CVE-2025-24890",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "57",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "gix-sec: gix-sec: Privilege escalation via incorrect repository trust on Windows",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24890.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-24890",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-14T19:00:48.323079Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-14T19:00:34.702Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "gitoxide",
              "vendor": "GitoxideLabs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.13.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator\u0027s privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-283",
                  "description": "CWE-283: Unverified Ownership",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T15:28:03.220Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
            },
            {
              "name": "https://github.com/GitoxideLabs/gitoxide/pull/2510",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/GitoxideLabs/gitoxide/pull/2510"
            },
            {
              "name": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559"
            },
            {
              "name": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3"
            }
          ],
          "source": {
            "advisory": "GHSA-7rhf-42qf-vrvc",
            "discovery": "UNKNOWN"
          },
          "title": "gix-sec safe.directory protections absent for elevated administrators"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-24890",
        "datePublished": "2026-09-14T15:28:03.220Z",
        "dateReserved": "2025-01-27T15:32:29.450Z",
        "dateUpdated": "2026-09-14T19:00:54.132Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-24890

Vulnerability from fkie_nvd - Published: 2026-09-14 16:17 - Updated: 2026-10-14 19:10

Severity

6.8 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559
	security-advisories@github.com	https://github.com/GitoxideLabs/gitoxide/pull/2510
	security-advisories@github.com	https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3
	security-advisories@github.com	https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.13.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator\u0027s privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3."
    },
    {
      "lang": "es",
      "value": "gitoxide es una implementaci\u00f3n de git escrita en Rust. Versiones anteriores a la 0.13.3, el crate gix-sec en Windows trata incorrectamente los repositorios controlados por otro usuario como de confianza cuando un administrador ejecuta un programa dependiente con un token elevado sin filtrar. En gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtiene folder_owner y token_owner, pero sus comprobaciones IsWellKnownSid y CheckTokenMembership espec\u00edficas del administrador examinan el token en ejecuci\u00f3n en lugar de confirmar el propietario del directorio. Esto elude la protecci\u00f3n de estilo safe.directory para repositorios propiedad y configurados por un usuario limitado, permitiendo que la configuraci\u00f3n del repositorio o los hooks ejecuten comandos con los privilegios del administrador cuando se realiza una operaci\u00f3n afectada. La explotaci\u00f3n requiere Windows, un administrador con privilegios elevados, un programa que dependa de los resultados de confianza de gix-sec y la interacci\u00f3n con un repositorio controlado por otro usuario. Un proceso UAC sin elevaci\u00f3n no se ve afectado, y la clonaci\u00f3n tampoco se ve afectada porque la configuraci\u00f3n del repositorio y los hooks no se copian. Este problema se ha solucionado en la versi\u00f3n 0.13.3."
    }
  ],
  "id": "CVE-2025-24890",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24890",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T19:00:48.323079Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T16:17:05.117",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f884bf4765dbe9c95a93dc2a92e559"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GitoxideLabs/gitoxide/pull/2510"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-sec-v0.13.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-283"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7RHF-42QF-VRVC

Vulnerability from github – Published: 2026-09-09 16:34 – Updated: 2026-09-09 16:34

Summary

gix-sec safe.directory protections absent for elevated administrators

Details

Summary

In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts.

Details

In a similar way to Git, gitoxide tries to avoid operating in local repositories that it neither considers to be owned by the current user nor finds to match any value of safe.directory. This is because of the numerous commands that can be configured for a Git repository, to run as part of various actions, some of which even occur automatically due to the way custom shell prompts and text editors update their knowledge of repositories.

On Unix-like operating systems, every directory is considered to be owned by some user ID. On Windows, other identities can own a directory in the same sense that a user can, and directories created while operating with full administrative rights default to being owned by the Administrators group, not the specific user. Such administrators should be able to use what are, conceptually, their own repositories. So Git considers administrators (when operating this way) to own them.

Code in gix-sec intends to implement a similar check. But after finding that it is run with an administrative token, it needs to check if the directory is owned by the Administrators group, yet instead accidentally examines itself again, rather than the directory.

Specifically, in gix_sec::identity the implementation of is_path_owned_by_current_user for Windows finds the owner of the directory (folder_owner), finds the owner of the running thread or process (token_owner), checks cases of ownership not specific to administrators, then attempts to check the administrator-specific case with:

https://github.com/GitoxideLabs/gitoxide/blob/ffb73b5f69dbe86ff88f1c473af65f368a6bcbe5/gix-sec/src/identity.rs#L197-L207

The IsWellKnownSid call checks if the owner of the current thread or process is the Administrators group. By default, operations carried out when running as an administrator with UAC elevation--or using an administrative account for which UAC is turned off altogether--create not just files and directories with the Administrators group as the owner, but other securable objects as well, including processes and threads. So this check returns true. (Based on the comment, it may be that this was really meant to check if the directory is owned by an administrator. But nothing related to the directory appears in this check.)

The CheckTokenMembership call checks if the owner of the current thread or process is an identity enabled in the access token represented by the token handle of NULL, passed as 0. But a token handle of NULL represents the running thread. Consequently, if we have gotten this far--which happens when running with full administrative rights--in nearly all situations this will return true as well. (Based on the message, it may be that this was really meant to check if the user is an administrator. But nothing related to the Administrators group appears in this check.)

PoC

These examples use gix fetch for simplicity, but some other actions implemented in gitoxide are vulnerable, as well as any provided by applications that rely on the results of gix-sec checks.

Example 1: From inside a shared or user profile directory

On Windows, running as a limited user account, create a repository in a shared location like C:\Users\Public, or even within the limited user's user profile directory. Configure a fake (or, if preferred, real) remote and a value of core.sshCommand that runs an arbitrary payload. For example, in PowerShell:

git init unsafe-repo
cd unsafe-repo
git remote add origin ssh://localhost/repo.git
git config core.sshCommand 'calc.exe; ssh'

Switch from the limited account to an administrative account. Then:

If gitoxide is not installed, install it, such as with cargo install gitoxide.
Run PowerShell with UAC elevation, so that it and processes started in it have an unfiltered token. (If UAC is turned off for this account, then just run PowerShell normally.)
This example will not work if the GIT_SSH_COMMAND environment variable is set. It is not usually set, but if it may be, you can unset it in the current shell environment by running $env:GIT_SSH_COMMAND = $null.
cd to the limited user's repository as created above.
Run gix fetch. This runs the Windows calculator (the chosen payload).

Example 2: From anywhere

On Windows, even limited user accounts can create directories in the root of the system drive. As a limited user--and assuming the system drive is C:--initialize C:\ itself as a repository. Set up the repository to run the payload, either by editing C:\.git\config manually, or by running the git remote and git config commands from example 1 but passing -c safe.directory=.. The second approach is as follows:

cd C:\
git init
git -c safe.directory=. remote add origin ssh://localhost/repo.git
git -c safe.directory=. config core.sshCommand 'calc.exe; ssh'

(-c safe.directory=. keeps git from refusing to run the git remote and git config commands on the repository it has just created, whose .git directory is under its control but whose working tree is not.) The entire system drive is now a Git repository due to the presence of C:\.git. The limited user owns this .git directory and controls the configuration in it. Normally safe.directory protections keep this from being a problem. But they are ineffective for administrators running applications (such as the gix command) that use gix-sec to enforce those protections.

Switch from the limited account to an administrative account. Follow the instructions for the administrator from example 1, except do so from any directory anywhere on the C: drive that is not in its own repository. Unless GIT_CEILING_DIRECTORIES is set in such a way that keeps C:\ from being considered, running gix fetch again runs the Windows calculator. This happens even if the command is run from inside the administrator's own user profile directory.

Impact

A user is affected only when all of the following apply:

The operating system is Windows.
The user is a member of the Administrators group.
The program is run with the user's unfiltered token. This happens when UAC is enabled and the user runs the program with UAC elevation, as well as when UAC is disabled. (Running as an administrator but enabling UAC and running the program unelevated is sufficient to avoid this vulnerability.)
The program uses and relies on information from gix-sec about what directories to trust.
The program interacts with a repository owned by, and set up or controlled by, another user.

Then operations that would run code present in a repository's configuration or hooks when the repository is trusted will be performed in any repository. These operations often require user interaction. But this interaction may not seem to the user like it involves operations on a repository, if it is performed as part of a custom prompt for a shell, or by other software that integrates with repositories. It may also not seem like it involves operation on files controlled by another user, such as when the repository is the root of the system drive.

A malicious user with a limited account on the system may therefore be able to arrange for an administrator to run arbitrary code. However, this vulnerability does not affect cloning repositories or using repositories one has cloned, because cloning does not copy configuration and hooks into the local repository.

The specific attack of making the root of the system drive a repository resembles CVE-2022-24765. The workarounds presented there do not work around this vulnerability in full, but would prevent that kind of attack.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.13.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-sec"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-24890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-283"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T16:34:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nIn a process run with full administrative rights on Windows, `gix-sec` wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts.\n\n### Details\n\nIn a similar way to Git, gitoxide tries to avoid operating in local repositories that it neither considers to be owned by the current user nor finds to match any value of `safe.directory`. [This is because](https://git-scm.com/docs/git.html#_security) of the numerous commands that can be configured for a Git repository, to run as part of various actions, some of which even occur automatically due to the way custom shell prompts and text editors update their knowledge of repositories.\n\nOn Unix-like operating systems, every directory is considered to be owned by some user ID. On Windows, other identities can own a directory in the same sense that a user can, and directories created while operating with full administrative rights default to being owned by the `Administrators` group, not the specific user. Such administrators should be able to use what are, conceptually, their own repositories. So Git considers administrators (when operating this way) to own them.\n\nCode in `gix-sec` intends to implement a similar check. But after finding that it is run with an administrative token, it needs to check if the directory is owned by the `Administrators` group, yet instead accidentally examines *itself* again, rather than the directory.\n\nSpecifically, in `gix_sec::identity` the [implementation](https://github.com/GitoxideLabs/gitoxide/blob/main/gix-sec/src/identity.rs#L81) of `is_path_owned_by_current_user` for Windows [finds the owner of the directory](https://github.com/GitoxideLabs/gitoxide/blob/ffb73b5f69dbe86ff88f1c473af65f368a6bcbe5/gix-sec/src/identity.rs#L109-L121) (`folder_owner`), [finds the owner of the running thread or process](https://github.com/GitoxideLabs/gitoxide/blob/ffb73b5f69dbe86ff88f1c473af65f368a6bcbe5/gix-sec/src/identity.rs#L151-L189) (`token_owner`), checks cases of ownership not specific to administrators, then attempts to check the administrator-specific case with:\n\nhttps://github.com/GitoxideLabs/gitoxide/blob/ffb73b5f69dbe86ff88f1c473af65f368a6bcbe5/gix-sec/src/identity.rs#L197-L207\n\nThe [`IsWellKnownSid`](https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-iswellknownsid) call checks if the owner of the current thread or process is the `Administrators` group. By default, operations carried out when running as an administrator with UAC elevation--or using an administrative account for which UAC is turned off altogether--create not just files and directories with the `Administrators` group as the owner, but other [securable objects](https://learn.microsoft.com/en-us/windows/win32/secauthz/securable-objects) as well, including processes and threads. So this check returns true. (Based on the comment, it may be that this was really meant to check if the *directory* is owned by an administrator. But nothing related to the directory appears in this check.)\n\nThe [`CheckTokenMembership`](https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-checktokenmembership) call checks if the owner of the current thread or process is an identity enabled in the access token represented by the token handle of `NULL`, passed as `0`. But a token handle of `NULL` represents the running thread. Consequently, if we have gotten this far--which happens when running with full administrative rights--in nearly all situations this will return true as well. (Based on the message, it may be that this was really meant to check if the user is an *administrator*. But nothing related to the `Administrators` group appears in this check.)\n\n### PoC\n\nThese examples use `gix fetch` for simplicity, but some other actions implemented in gitoxide are vulnerable, as well as any provided by applications that rely on the results of `gix-sec` checks. \n\n#### Example 1: From inside a shared or user profile directory\n\nOn Windows, running as a limited user account, create a repository in a shared location like `C:\\Users\\Public`, or even within the limited user\u0027s user profile directory. Configure a fake (or, if preferred, real) remote and a value of `core.sshCommand` that runs an arbitrary payload. For example, in PowerShell:\n\n```powershell\ngit init unsafe-repo\ncd unsafe-repo\ngit remote add origin ssh://localhost/repo.git\ngit config core.sshCommand \u0027calc.exe; ssh\u0027\n```\n\nSwitch from the limited account to an administrative account. Then:\n\n1. If gitoxide is not installed, install it, such as with `cargo install gitoxide`.\n2. Run PowerShell with UAC elevation, so that it and processes started in it have an unfiltered token. (If UAC is turned off for this account, then just run PowerShell normally.)\n3. This example will not work if the `GIT_SSH_COMMAND` environment variable is set. It is not usually set, but if it may be, you can unset it in the current shell environment by running `$env:GIT_SSH_COMMAND = $null`.\n4. `cd` to the limited user\u0027s repository as created above.\n5. Run `gix fetch`. This runs the Windows calculator (the chosen payload).\n\n#### Example 2: From anywhere\n\nOn Windows, even limited user accounts can create directories in the root of the system drive. As a limited user--and assuming the system drive is `C:`--initialize `C:\\` itself as a repository. Set up the repository to run the payload, either by editing `C:\\.git\\config` manually, or by running the `git remote` and `git config` commands from example 1 but passing `-c safe.directory=.`. The second approach is as follows:\n\n```powershell\ncd C:\\\ngit init\ngit -c safe.directory=. remote add origin ssh://localhost/repo.git\ngit -c safe.directory=. config core.sshCommand \u0027calc.exe; ssh\u0027\n```\n\n(`-c safe.directory=.` keeps `git` from refusing to run the `git remote` and `git config` commands on the repository it has just created, whose `.git` directory is under its control but whose working tree is not.)\n\u00a0\nThe entire system drive is now a Git repository due to the presence of `C:\\.git`. The limited user owns this `.git` directory and controls the configuration in it. Normally `safe.directory` protections keep this from being a problem. But they are ineffective for administrators running applications (such as the `gix` command) that use `gix-sec` to enforce those protections.\n\nSwitch from the limited account to an administrative account. Follow the instructions for the administrator from example 1, except do so from *any* directory anywhere on the `C:` drive that is not in its own repository. Unless `GIT_CEILING_DIRECTORIES` is set in such a way that keeps `C:\\` from being considered, running `gix fetch` again runs the Windows calculator. This happens even if the command is run from inside the administrator\u0027s own user profile directory.\n\n### Impact\n\nA user is affected only when *all* of the following apply:\n\n- The operating system is Windows.\n- The user is a member of the `Administrators` group.\n- The program is run with the user\u0027s unfiltered token. This happens when UAC is enabled and the user runs the program with UAC elevation, as well as when UAC is disabled. (Running as an administrator but enabling UAC and running the program unelevated is sufficient to avoid this vulnerability.)\n- The program uses and relies on information from `gix-sec` about what directories to trust.\n- The program interacts with a repository owned by, and set up or controlled by, another user.\n\nThen operations that would run code present in a repository\u0027s configuration or hooks when the repository is trusted will be performed in any repository. These operations often require user interaction. But this interaction may not seem to the user like it involves operations on a repository, if it is performed as part of a custom prompt for a shell, or by other software that integrates with repositories. It may also not seem like it involves operation on files controlled by another user, such as when the repository is the root of the system drive.\n\nA malicious user with a limited account on the system may therefore be able to arrange for an administrator to run arbitrary code. However, this vulnerability does not affect cloning repositories or using repositories one has cloned, because cloning does not copy configuration and hooks into the local repository.\n\nThe specific attack of making the root of the system drive a repository resembles [CVE-2022-24765](https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2). The workarounds presented there do not work around this vulnerability in full, but would prevent that kind of attack.",
  "id": "GHSA-7rhf-42qf-vrvc",
  "modified": "2026-09-09T16:34:36Z",
  "published": "2026-09-09T16:34:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-7rhf-42qf-vrvc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GitoxideLabs/gitoxide/commit/39e37482d6f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/GitoxideLabs/gitoxide"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gix-sec safe.directory protections absent for elevated administrators"
}

MSRC_CVE-2025-24890

Vulnerability from csaf_microsoft - Published: 2026-09-15 01:08 - Updated: 2026-09-17 01:45

Summary

gix-sec safe.directory protections absent for elevated administrators

Scope

1 vulnerability in this advisory, including CVE-2025-24890.

CVE-2025-24890

Known not affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-24890 (GCVE-0-2025-24890)

FKIE_CVE-2025-24890

GHSA-7RHF-42QF-VRVC

Summary

Details

PoC

Example 1: From inside a shared or user profile directory

Example 2: From anywhere

Impact

MSRC_CVE-2025-24890

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour