CVE-2025-54583 json
GitProxy bypasses approvals when pushing multiple branches
published last yr. modified 4mo ago also GHSA-qr93-8wwf-22g4 , EUVD-2025-23195
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
Patch / fix
- npm @finos/git-proxy 1.19.2
- finos gitproxy 1.19.2
Is CVE-2025-54583 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/finos/git-proxy/security/advisories/GHSA-qr93-8wwf-22g4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N |
| CNA | 4.0 | 8.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @finos/git-proxy | <1.19.2 |
1.19.2 |
Affected products
- finos git-proxy
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a
web, patch
-
github.com
/finos/git-proxy/commit/bd2ecb2099cba21bca3941ee4d655d2eb887b3a9
web, patch
-
github.com
/finos/git-proxy/releases/tag/v1.19.2
web, patch, release-notes
-
github.com
/finos/git-proxy/security/advisories/GHSA-qr93-8wwf-22g4
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-54583
advisory
-
github.com
/finos/git-proxy
package
Sources
- CVE List CVE-2025-54583
- GitHub Advisory GHSA-qr93-8wwf-22g4
- NVD CVE-2025-54583
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.