Medium, CVSS 6.8crates.ioAmendedPublished
gix-sec safe.directory protections absent for elevated administrators
CVE-2025-24890 · GHSA-7rhf-42qf-vrvc
- Affected
- crates.io gix-sec <= 0.13.2
- Fixed in
- 0.13.3· Vendor fix available
- Issue
- In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local repositories that it neither considers to be owned by the current user nor finds to match any value of safe.directory. This is because of the numerous commands that can be configured for a Git repository, to run as part of various actions, some of which even occur automatically due to the way custom shell prompts and text editors update their knowledge of repositories. On Unix-like operating systems, every directory is considered to be owned by some user ID. On Windows, other identities can own a directory in the same sense that a user can, and directories created while operating with full administrative rights default to being owned by the Administrators group, not the specific user. Such…
Recommended action: Upgrade to 0.13.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.