CVE-2025-54585

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54585
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54585.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54585
Aliases
Published
2025-07-30T20:17:20.844Z
Modified
2026-04-10T05:30:39.411276Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
Summary
GitProxy is vulnerable to a new branch approval exploit
Details

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to enforce policy and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. This is fixed in version 1.19.2.

Database specific 
{
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54585.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/finos/git-proxy

Affected ranges

Type
GIT
Repo
https://github.com/finos/git-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
12fce21a18b86f7637b61dbe25e788528cc6ea93

Affected versions

license-inventory-0.*
license-inventory-0.0.1
license-inventory-0.0.2
sample-0.*
sample-0.1.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.19.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.10
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54585.json"