Medium severity5.7NVD Advisory· Published Jul 30, 2025· Updated Jun 17, 2026
CVE-2025-54584
CVE-2025-54584
Description
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@finos/git-proxynpm | < 1.19.2 | 1.19.2 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0fnvdPatchWEB
- github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3anvdPatchWEB
- github.com/finos/git-proxy/releases/tag/v1.19.2nvdPatchRelease NotesWEB
- github.com/finos/git-proxy/security/advisories/GHSA-xxmh-rf63-qwjvnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-xxmh-rf63-qwjvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-54584ghsaADVISORY
News mentions
0No linked articles in our index yet.