PT-2025-31448 · Gitproxy · Git-Proxy

Coopernetes · Published 2025-07-30 · Updated 2025-07-31 · CVE-2025-54586

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitProxy versions 1.19.1 and below

Description GitProxy is an application that acts as an intermediary between developers and a Git remote endpoint. Attackers can inject extra commits into the pack sent to GitHub, commits that are not associated with any branch. These “hidden” commits are not visible in the repository’s history but are still accessible via their direct commit URLs, allowing an attacker to exfiltrate sensitive data without leaving a trace in the branch view. This compromises repository confidentiality. The vulnerability occurs because the proxy only trusts the ref-update line and does not inspect the packfile’s contents, failing to verify which commits are actually included in the pack.

Recommendations Update to GitProxy version 1.19.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-54586

GHSA-V98G-8RQX-G93G

Affected Products

Git-Proxy

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54586.json · Exploit
• 🔥 https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g · Exploit
• https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a · Patch
• https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110 · Patch
• https://github.com/finos/git-proxy/releases/tag/v1.19.2 · Patch
• https://osv.dev/vulnerability/CVE-2025-54586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54586 · Security Note
• https://osv.dev/vulnerability/GHSA-v98g-8rqx-g93g · Vendor Advisory
• https://github.com/finos/git-proxy · Note
• https://t.me/CVEtracker/28791 · Telegram Post
• https://twitter.com/CVEnew/status/1950671833394786611 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950835284754456906 · Twitter Post
• https://t.me/cveNotify/130332 · Telegram Post