CVE-2025-54586 GitProxy is susceptible to a hidden commits injection attack
Attackers can inject hidden commits into GitProxy to exfiltrate sensitive data without leaving traces in the visible repository history.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54586?
CVE-2025-54586 is a high-severity vulnerability in finos git-proxy, published on 30 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.
Weakness: CWE-200
Which versions are affected by CVE-2025-54586?
2 open source packages ship an affected version, including @finos/git-proxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@finos/git-proxy npm | All versions | 1.19.2 |
@finos/git-proxy npm | All versions | 1.19.2 |
Products include Finos Gitproxy.
How do I fix CVE-2025-54586?
Upgrade @finos/git-proxy to 1.19.2 or later.
Is CVE-2025-54586 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54586 exists.
Other vulnerabilities in finos git-proxy
Sources
Also known as GHSA-v98g-8rqx-g93g.