CVE-2025-54585: FINOS GitProxy authorization bypass in new branch creation

CVE-2025-54585 · Severity: medium · CVSS 4 · Published 2025-07-30

GitProxy is a security tool that sits between developers and a Git server to enforce code approval policies. A vulnerability was found where an attacker could bypass these mandatory approval checks by creating a new branch from an unapproved commit and getting a subsequent minor change approved on that new branch. This allows unauthorized code to be pushed to protected repositories, potentially compromising the integrity of the software development lifecycle.

Technologies: @finos/git-proxy (npm). Vendors: npm.

Quick answers

Is CVE-2025-54585 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-54585 being exploited in the wild.
How severe is CVE-2025-54585?
Medium severity, with a CVSS score of 4, published 30 July 2025.
Which products and versions are affected?
FINOS Git-Proxy <= 1.19.1; @finos/git-proxy (npm) SEMVER:introduced=0,fixed=1.19.2.
Is there a fix for CVE-2025-54585?
Yes. @finos/git-proxy (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54585 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-54585?
Check whether you run FINOS Git-Proxy or @finos/git-proxy (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @finos/git-proxy (npm): upgrade to 1.19.2 or later
    npm install @finos/git-proxy@1.19.2

Technical details

A vulnerability in GitProxy versions 1.19.1 and earlier allows for an authorization bypass (CWE-285) during the push process. The application uses a null hash (00000000...) to detect new branch creation in 'getDiff.ts' and 'parsePush.ts'. An attacker with standard push access can commit unapproved code to a parent branch, create a new child branch from that commit, and obtain approval for a secondary commit on the child branch. Due to flawed logic in how the proxy tracks pending approvals across branches, pushing the child branch can inadvertently validate and allow the original unapproved parent commits to reach the remote repository. This is fixed in version 1.19.2 by requiring explicit approval for commits originating from the parent branch during such flows.

Affected products

  • FINOS @finos/git-proxy <= 1.19.1

Identifiers

  • CVE-2025-54585
  • GHSA-39p2-8hq9-fwj6

Timeline

  • 2025-07-30: disclosed
  • 2025-07-30: advisory
  • 2025-07-30: patched: Fixed in version 1.19.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.