The gix-worktree-state component has a vulnerability where executable files checked out nonexclusively are set with 0777 permissions, making them world-writable. This occurs because one method of setting permissions bypasses the umask, resulting in overly permissive file modes. The issue affects versions prior to 0.17.0 and has been fixed in version 0.17.0.