CVE-2025-24890 GitoxideLabs CVE debrief

Who should care

Windows administrators and developers using gitoxide should assess exposure and verify their installations, prioritizing upgrades to version 0.13.3 or later. They should review Windows systems for affected gitoxide installations, monitor administrator interactions with git repositories, and implement safe.directory-style protections for git repositories. Additionally, they should confirm whether affected product deployments exist in managed environments, 0

Why it matters

CVE-2025-24890 is a medium-severity vulnerability in gitoxide on Windows, allowing potential privilege escalation via git repository configuration or hooks when administrators interact with repositories controlled by other users.

• Potential privilege escalation for administrators interacting with git repositories
• Execution of commands with administrator privileges via repository configuration or hooks
• Verification of gitoxide version and safe.directory-style protections required
• Limited user repository configuration may lead to elevated command execution

Technical summary

The gix-sec crate in gitoxide incorrectly trusts repositories controlled by another user when an administrator runs a dependent program with an unfiltered elevated token on Windows. This allows repository configuration or hooks to execute commands with the administrator's privileges. The issue arises from gix_sec::identity::is_path_owned_by_current_user obtaining folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the 0

Defensive priority

Defenders should prioritize verifying and upgrading to gitoxide version 0.13.3 or later, especially in Windows environments where administrators interact with git repositories.

Recommended defensive actions

• Verify gitoxide version and upgrade to 0.13.3 or later
• Review Windows systems for affected gitoxide installations
• Monitor administrator interactions with git repositories
• Implement safe.directory-style protections for git repositories
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub references offer additional context and a fix in version 0.13.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.