CVE-2025-54584 - CVE House
Back to Database
Status published High CVE-2025-54584

GitProxy is vulnerable to a packfile parsing exploit

Vulnerability Description

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54584

Credits & Attribution

No credits recorded in the NVD database.

References

More from finos

View All →
CVE-2025-54586
GitProxy is susceptible to a hidden commits injection attack
High 7.1
CVE-2025-54585
GitProxy is vulnerable to a new branch approval exploit
High 8.2
CVE-2025-54583
GitProxy bypasses approvals when pushing multiple branches
High 8.3

Affected Vendor

Affected Software

git-proxy
Vulnerable Versions:
< 1.19.2

Timeline

Official Publish: July 30th, 2025
Last Modified: July 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-115

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.