CVE-2025-54583highCWE-863

CVE-2025-54583: falha de alta gravidade em finos git-proxy

GitProxy bypasses approvals when pushing multiple branches

Publicada em

Seguir esta CVE+ Monitorar git-proxy+ Monitorar @finos/git-proxy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.5%
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Produtos afetados
finos · git-proxy
CVEs relacionadas — finos git-proxy

No mesmo produto, das mais perigosas para as menos.

CVE-2025-54584HIGHGitProxy is vulnerable to a packfile parsing exploitEPSS 0.6%CVE-2025-54585HIGHGitProxy is vulnerable to a new branch approval exploitEPSS 0.4%CVE-2025-54586HIGHGitProxy is susceptible to a hidden commits injection attackEPSS 0.4%