CVE-2025-54583highCWE-863

CVE-2025-54583: high-severity vulnerability in finos git-proxy

GitProxy bypasses approvals when pushing multiple branches

Published

Follow this CVE+ Monitor git-proxy+ Monitor @finos/git-proxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.5%
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Affected products
finos · git-proxy
Related CVEs — finos git-proxy

In the same product, most dangerous first.

CVE-2025-54584HIGHGitProxy is vulnerable to a packfile parsing exploitEPSS 0.6%CVE-2025-54585HIGHGitProxy is vulnerable to a new branch approval exploitEPSS 0.4%CVE-2025-54586HIGHGitProxy is susceptible to a hidden commits injection attackEPSS 0.4%