CVE-2025-54585 - GitProxy is vulnerable to a new branch approval exploit

Back Back to CVE browser

HIGH

GitProxy is vulnerable to a new branch approval exploit

Published Jul 30, 2025

8.2

HIGH

CVSS 4.0

EPSS 0.37%

Description

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to enforce policy and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. This is fixed in version 1.19.2.

Affected products

Vendor Finos Product Git-Proxy Default
n/a
- Version
  < 1.19.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Finos

Git-Proxy

n/a

Version	Status	Constraints
< 1.19.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	@finos/git-proxy	0	1.19.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-285

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23205
Advisory
https://github.com/advisories/GHSA-39p2-8hq9-fwj6
Advisory
https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a
x_refsource_MISCPatch
https://github.com/finos/git-proxy/commit/f99fe42082eab0970e4cd0acdc3421a527a7e531
x_refsource_MISCPatch
https://github.com/finos/git-proxy/releases/tag/v1.19.2
x_refsource_MISCPatchRelease Notes
https://github.com/finos/git-proxy/security/advisories/GHSA-39p2-8hq9-fwj6
x_refsource_CONFIRMExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-54585

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23205		Advisory
https://github.com/advisories/GHSA-39p2-8hq9-fwj6		Advisory
https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a		x_refsource_MISCPatch
https://github.com/finos/git-proxy/commit/f99fe42082eab0970e4cd0acdc3421a527a7e531		x_refsource_MISCPatch
https://github.com/finos/git-proxy/releases/tag/v1.19.2		x_refsource_MISCPatchRelease Notes
https://github.com/finos/git-proxy/security/advisories/GHSA-39p2-8hq9-fwj6		x_refsource_CONFIRMExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-54585