CVE-2025-54584: gitproxy — Exploit & Fix

Description

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.

Is your site exposed to CVE-2025-54584?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness Type (CWE)

CWE-115 CWE-115

Affected Products

Vendor	Product	Versions
finos	gitproxy	< 1.19.2

References

Advisories & Patches

https://github.com/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0f https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a https://github.com/finos/git-proxy/releases/tag/v1.19.2

Exploits

https://github.com/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjv

Frequently Asked Questions

What is CVE-2025-54584? +

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2. It has a CVSS v3.1 base score of 5.7 (MEDIUM).

How severe is CVE-2025-54584? +

CVE-2025-54584 has a CVSS v3.1 score of 5.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-54584? +

CVE-2025-54584 affects products from finos, specifically: gitproxy. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-54584? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-5747 8.0

WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers …

CVE-2024-11169 7.5

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module …

CVE-2025-32908 7.5

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, …

CVE-2025-25069 6.5

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP …

CVE-2023-32260 6.5

Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud …

CVE-2025-68113 6.5

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload …

CVE-2025-54584