Is CVE-2025-54586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54586 being exploited in the wild.

How severe is CVE-2025-54586?

Low severity, with a CVSS score of 3.1, published 30 July 2025.

Which products and versions are affected?

FINOS GitProxy before 1.19.2; @finos/git-proxy (npm) SEMVER:introduced=0,fixed=1.19.2.

Is there a fix for CVE-2025-54586?

Yes. @finos/git-proxy (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54586 attacked?

It is attacked over the network.

Am I affected by CVE-2025-54586?

Check whether you run FINOS GitProxy or @finos/git-proxy (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54586: GitProxy hidden commits injection vulnerability

CVE-2025-54586 · Severity: low · CVSS 3.1 · Published 2025-07-30

GitProxy is a Git proxy service used to mediate and control access to Git repositories hosted on GitHub. An attacker with push access can inject malicious commits into the repository that never appear in visible branch history but remain accessible directly by commit URL, allowing them to secretly exfiltrate sensitive data like credentials or proprietary code without leaving any audit trail in the repository's normal view.

Technologies: @finos/git-proxy (npm). Vendors: npm.

Quick answers

Is CVE-2025-54586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54586 being exploited in the wild.
How severe is CVE-2025-54586?: Low severity, with a CVSS score of 3.1, published 30 July 2025.
Which products and versions are affected?: FINOS GitProxy before 1.19.2; @finos/git-proxy (npm) SEMVER:introduced=0,fixed=1.19.2.
Is there a fix for CVE-2025-54586?: Yes. @finos/git-proxy (npm): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54586 attacked?: It is attacked over the network.
Am I affected by CVE-2025-54586?: Check whether you run FINOS GitProxy or @finos/git-proxy (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@finos/git-proxy (npm): upgrade to 1.19.2 or later
```
npm install @finos/git-proxy@1.19.2
```

Technical details

The vulnerability is a pack validation bypass (CWE-200, exposure of sensitive data) in GitProxy's packfile handling. The proxy validates only the ref-update line but does not inspect the actual contents of the Git packfile being pushed. An attacker can craft a packfile containing extra commits beyond those expected from the ref update, and since the code only runs `git rev-list oldOid..newOid` without verifying which commits actually arrived, these "hidden" commits are stored by GitHub but never referenced by any branch. The attack requires authentication (an account with push rights to a repository) and network access to the proxy. Although the hidden commits do not appear in UI or branch graphs, GitHub serves them via direct commit URLs indefinitely, enabling data exfiltration. The vulnerability is patched in version 1.19.2 and later.

Affected products

FINOS GitProxy before 1.19.2

Identifiers

CVE-2025-54586
GHSA-v98g-8rqx-g93g

Timeline

2025-07-30: disclosed
2025-07-30: patched: Version 1.19.2 and 2.0.0

References

https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.