CVE-2025-54586

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110	Patch
https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a	Patch
https://github.com/finos/git-proxy/releases/tag/v1.19.2	Patch Release Notes
https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g	Exploit Third Party Advisory
https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:finos:gitproxy:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-30 22:15

Updated : 2025-08-01 20:03

NVD link : CVE-2025-54586

Mitre link : CVE-2025-54586

CVE.ORG link : CVE-2025-54586

JSON object : View

Products Affected

finos

gitproxy

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-54586", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-07-30T22:15:25.120", "references": [{"url": "https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/finos/git-proxy/releases/tag/v1.19.2", "tags": ["Patch", "Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren\u2019t pointed to by any branch. Although these \u201chidden\u201d commits never show up in the repository\u2019s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High\u2011impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2."}, {"lang": "es", "value": "GitProxy es una aplicaci\u00f3n que se interpone entre los desarrolladores y un endpoint remoto de Git. En las versiones 1.19.1 y anteriores, los atacantes pueden inyectar commits adicionales en el paquete enviado a GitHub, commits que no est\u00e1n dirigidos por ninguna rama. Aunque estos commits \"ocultos\" nunca aparecen en el historial visible del repositorio, GitHub los muestra en sus URL de commit directo. Esto permite a un atacante extraer datos confidenciales sin dejar rastro en la vista de la rama. Esta vulnerabilidad se considera de alto impacto porque compromete completamente la confidencialidad del repositorio. Se ha corregido en la versi\u00f3n 1.19.2."}], "lastModified": "2025-08-01T20:03:03.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:finos:gitproxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5066AC65-E6FA-4582-AE66-0CBBED07F809", "versionEndExcluding": "1.19.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}