CVE-2025-54583: FINOS GitProxy approval bypass when pushing multiple branches

CVE-2025-54583 · Severity: medium · CVSS 4 · Published 2025-07-30

GitProxy is a tool used to enforce code review policies and prevent unauthorized code changes from being pushed to repositories. A flaw in the push parsing logic allows attackers with regular push access to bypass approval workflows by pushing multiple branches simultaneously—the proxy only validates the first branch while silently accepting subsequent ones, potentially allowing malicious or unapproved code to reach the repository.

Technologies: @finos/git-proxy (npm). Vendors: npm.

Quick answers

Is CVE-2025-54583 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-54583 being exploited in the wild.
How severe is CVE-2025-54583?
Medium severity, with a CVSS score of 4, published 30 July 2025.
Which products and versions are affected?
FINOS GitProxy <= 1.19.1; @finos/git-proxy (npm) SEMVER:introduced=0,fixed=1.19.2.
Is there a fix for CVE-2025-54583?
Yes. @finos/git-proxy (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54583 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-54583?
Check whether you run FINOS GitProxy or @finos/git-proxy (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @finos/git-proxy (npm): upgrade to 1.19.2 or later
    npm install @finos/git-proxy@1.19.2

Technical details

The vulnerability exists in the parsePush.ts component, which processes git push operations but only validates the first branch in a multi-branch push while silently ignoring subsequent branches. An attacker with standard push access can craft a push request with multiple branch references (e.g., `git push proxy safe-branch bad-branch`), causing the proxy to approve and process only the first branch while the second bypasses all checks, policies, and approval workflows. The attack requires push access and a prior approval of the first branch, but no elevated privileges or user interaction beyond initiating the push. The fix involves enforcing single-branch push validation and rejecting multi-branch requests before policy checks are applied. Patched versions 1.19.2 and 2.0.0 are available.

Affected products

  • FINOS GitProxy <= 1.19.1

Identifiers

  • CVE-2025-54583
  • GHSA-qr93-8wwf-22g4

Timeline

  • 2025-07-30: disclosed
  • 2025-07-30: patched: versions 1.19.2 and 2.0.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.