CVE-2025-24890
Received Received - Intake

Privilege Escalation in gitoxide via Trusted Repository Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator's privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2025-24890
EUVD
EUVD-2025-210908

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gitoxide gix-sec 0.13.3
gitoxide gitoxide to 0.13.3 (exc)
gitoxide gitoxide From 0.13.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-283 The product does not properly verify that a critical resource is owned by the proper entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-24890 is a vulnerability in the gix-sec library (versions <= 0.13.2) affecting Windows systems. It allows elevated administrators to be tricked into trusting repositories owned by other users due to flawed ownership checks. The is_path_owned_by_current_user function incorrectly verifies the process owner instead of the directory owner, bypassing safe.directory protections. Attackers with limited accounts can exploit this by setting up malicious repositories in shared directories.

Detection Guidance

This vulnerability specifically affects Windows systems using gix-sec versions <= 0.13.2. To detect it, check the installed version of gix-sec with: gitoxide --version or cargo list --package gix-sec. If the version is <= 0.13.2, the system is vulnerable. Additionally, verify if any programs rely on gix-sec for trust checks on Windows with elevated administrator privileges.

Impact Analysis

This vulnerability allows attackers with limited user accounts to execute arbitrary commands with administrator privileges. If an administrator runs a program relying on gix-sec with elevated rights, malicious repository configurations or hooks could run unintended code. Exploitation requires Windows, an elevated administrator, and interaction with a repository controlled by another user.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution with elevated privileges. If an administrator with unfiltered elevated token interacts with a malicious repository owned by another user, it may allow execution of commands configured in the repository (e.g., via core.sshCommand). This could lead to unauthorized access to sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA.

Mitigation Strategies

Upgrade gix-sec to version 0.13.3 or later immediately. This can be done via cargo update -p gix-sec or by updating the gitoxide project. Ensure UAC is enabled and avoid running programs with unfiltered elevated tokens. Review programs that depend on gix-sec for trust checks and verify their configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-24890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart