Skip to content

Product

finos @finos/git-proxy vulnerabilities

4 published CVES affecting finos @finos/git-proxy, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
3
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest finos @finos/git-proxy CVEs

Newest publication first

  1. CVE-2025-54586 GitProxy is susceptible to a hidden commits injection attack

    Published
    MediumCVSS 6.5

    GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the r...

  2. CVE-2025-54585 GitProxy is vulnerable to a new branch approval exploit

    Published
    HighCVSS 8.2

    GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users...

  3. CVE-2025-54584 GitProxy is vulnerable to a packfile parsing exploit

    Published
    HighCVSS 7.0

    GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK si...

  4. CVE-2025-54583 GitProxy bypasses approvals when pushing multiple branches

    Published
    HighCVSS 8.3

    GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.