CVE-2025-54586 Details
Description
GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.
A vulnerability in GitProxy versions through 1.19.1 allows attackers to inject hidden commits into the pack sent to GitHub. These commits, not referenced by any branch, remain invisible in the repository's history but can be accessed via their direct commit URLs. This flaw enables the exfiltration of sensitive data without detection, as the hidden commits do not appear in the branch view. The vulnerability arises because GitProxy trusts only the ref-update line and fails to verify the packfile's contents, allowing malicious clients to append unreferenced commits. The issue has been addressed in GitProxy version 1.19.2.
Users are advised to upgrade to GitProxy version 1.19.2 or 2.0.0, both of which include patches for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110 | [email protected] | Patch |
| https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a | [email protected] | Patch |
| https://github.com/finos/git-proxy/releases/tag/v1.19.2 | [email protected] | PatchRelease Notes |
| https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| finos gitproxy | < 1.19.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2025 | Initial Analysis | [email protected] |
| Jul 31, 2025 | CVE Modified | CISA-ADP |
| Jul 30, 2025 | New CVE Received | [email protected] |