CVE-2025-54586

Name: CVE-2025-54586
Creator: NVD / NIST
Published: 2025-07-30T22:15:25.12+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 0.33%

Last modified Jun 17, 2026

CVE-2025-54586 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. EPSS estimates a 0.33% chance of exploitation in the next 30 days.

Description

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

0.33%

24.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Finos	Gitproxy	< 1.19.2

References

https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110Patch
https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3aPatch
https://github.com/finos/git-proxy/releases/tag/v1.19.2Patch, Release Notes
https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93gExploit, Third Party Advisory
https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93gExploit, Third Party Advisory

Timeline

Published: Jul 30, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-54586?

How severe is CVE-2025-54586?

CVE-2025-54586 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.33% probability of exploitation in the next 30 days.

How do I fix CVE-2025-54586?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-54586?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST