GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Finos
  • Git-proxy
  • Gitproxy

Configuration 1 [-]

cpe:2.3:a:finos:gitproxy:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0f cve-icon cve-icon
https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a cve-icon cve-icon
https://github.com/finos/git-proxy/releases/tag/v1.19.2 cve-icon cve-icon
https://github.com/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjv cve-icon cve-icon
History

Fri, 01 Aug 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Finos gitproxy
CPEs cpe:2.3:a:finos:gitproxy:*:*:*:*:*:*:*:*
Vendors & Products Finos gitproxy
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N'}

Thu, 31 Jul 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Finos
Finos git-proxy
Vendors & Products Finos
Finos git-proxy

Wed, 30 Jul 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Jul 2025 20:15:00 +0000

Type Values Removed Values Added
Description GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
Title GitProxy is vulnerable to a packfile parsing exploit
Weaknesses CWE-115
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-07-30T20:01:16.338Z

Updated: 2025-07-30T20:19:21.613Z

Reserved: 2025-07-25T16:19:16.093Z

Link: CVE-2025-54584

cve-icon Vulnrichment

Updated: 2025-07-30T20:19:11.836Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-30T20:15:38.357

Modified: 2025-08-01T20:04:28.420

Link: CVE-2025-54584

cve-icon Redhat

No data.