PT-2025-31443 · Gitproxy · Git-Proxy

Dgl · Published 2025-07-30 · Updated 2025-07-31 · CVE-2025-54584

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions GitProxy versions 1.19.1 and below

Description GitProxy is an application that acts as an intermediary between developers and a Git remote endpoint. A crafted malicious Git packfile can exploit the PACK signature detection in the parsePush.ts file. Embedding a misleading PACK signature within commit content and carefully constructing the packet structure can trick the parser into treating invalid data as the packfile, potentially allowing bypassing approval or hiding commits.

Recommendations Update to version 1.19.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-115

Related Identifiers

CVE-2025-54584

GHSA-XXMH-RF63-QWJV

Affected Products

Git-Proxy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54584.json · Exploit
• 🔥 https://github.com/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjv · Exploit
• https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a · Patch
• https://github.com/finos/git-proxy/releases/tag/v1.19.2 · Patch
• https://github.com/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0f · Patch
• https://osv.dev/vulnerability/CVE-2025-54584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54584 · Security Note
• https://osv.dev/vulnerability/GHSA-xxmh-rf63-qwjv · Vendor Advisory
• https://github.com/finos/git-proxy · Note
• https://twitter.com/CVEnew/status/1950651994114330846 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950709861940969879 · Twitter Post
• https://t.me/CVEtracker/28785 · Telegram Post