CVE-2025-54584highCWE-115

CVE-2025-54584: high-severity vulnerability in finos git-proxy

GitProxy is vulnerable to a packfile parsing exploit

Published

Follow this CVE+ Monitor git-proxy+ Monitor @finos/git-proxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.6%
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Affected products
finos · git-proxy
Related CVEs — finos git-proxy

In the same product, most dangerous first.

CVE-2025-54583HIGHGitProxy bypasses approvals when pushing multiple branchesEPSS 0.5%CVE-2025-54585HIGHGitProxy is vulnerable to a new branch approval exploitEPSS 0.4%CVE-2025-54586HIGHGitProxy is susceptible to a hidden commits injection attackEPSS 0.4%