CVE-2025-54585 GitProxy is vulnerable to a new branch approval exploit
Attackers can bypass commit approval policies on parent branches when creating new branches in GitProxy, allowing unapproved code changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-54585?
CVE-2025-54585 is a high-severity missing authorization vulnerability in finos git-proxy, published on 30 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to enforce policy and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. This is fixed in version 1.19.2.
Weakness: CWE-285
Which versions are affected by CVE-2025-54585?
2 open source packages ship an affected version, including @finos/git-proxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@finos/git-proxy npm | All versions | 1.19.2 |
@finos/git-proxy npm | All versions | 1.19.2 |
Products include Finos Gitproxy.
How do I fix CVE-2025-54585?
Upgrade @finos/git-proxy to 1.19.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-54585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54585 exists.
Other vulnerabilities in finos git-proxy
Sources
Also known as GHSA-39p2-8hq9-fwj6.