CVE-2025-54583highCWE-863

CVE-2025-54583: fallo de gravedad alta en finos git-proxy

GitProxy bypasses approvals when pushing multiple branches

Publicada el

Seguir esta CVE+ Monitorear git-proxy+ Monitorear @finos/git-proxy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 0.5%
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Productos afectados
finos · git-proxy
CVEs relacionadas — finos git-proxy

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-54584HIGHGitProxy is vulnerable to a packfile parsing exploitEPSS 0.6%CVE-2025-54585HIGHGitProxy is vulnerable to a new branch approval exploitEPSS 0.4%CVE-2025-54586HIGHGitProxy is susceptible to a hidden commits injection attackEPSS 0.4%