CVE-2025-54584 json
GitProxy is vulnerable to a packfile parsing exploit
published 2025-07-30 15 mo ago modified 2026-06-17 4 mo ago also GHSA-xxmh-rf63-qwjv , EUVD-2025-23193
- cvss
- 5.7
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
Patch / fix
- npm @finos/git-proxy 1.19.2
- finos gitproxy 1.19.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @finos/git-proxy | <1.19.2 |
1.19.2 |
Affected products
- finos git-proxy
Classification
- Weakness
-
- CWE-115 Misinterpretation of Input
References
-
github.com
/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0f
web, patch
-
github.com
/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a
web, patch
-
github.com
/finos/git-proxy/releases/tag/v1.19.2
web, patch, release-notes
-
github.com
/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjv
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-54584
advisory
-
github.com
/finos/git-proxy
package
Sources
- CVE List CVE-2025-54584
- GitHub Advisory GHSA-xxmh-rf63-qwjv
- NVD CVE-2025-54584
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.