CVE-2025-54584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54584
Aliases
Published
2025-07-30T20:01:16.338Z
Modified
2026-04-10T05:30:39.420312Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
Summary
GitProxy is vulnerable to a packfile parsing exploit
Details

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-115"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54584.json"
}
References

Affected packages

Git / github.com/finos/git-proxy

Affected ranges

Type
GIT
Repo
https://github.com/finos/git-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
12fce21a18b86f7637b61dbe25e788528cc6ea93

Affected versions

license-inventory-0.*
license-inventory-0.0.1
license-inventory-0.0.2
sample-0.*
sample-0.1.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.19.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.10
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54584.json"