CVE-2025-54583: GitProxy bypasses approvals when pushing multiple branches

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-30 · updated 2026-06-17
Weakness: CWE-863

Description

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.

Affected products

finos Gitproxy: before 1.19.2 — fixed in 1.19.2

How to fix

Upgrade to a fixed version: finos Gitproxy 1.19.2. Check the vendor advisory for mitigations.

References

https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a
https://github.com/finos/git-proxy/commit/bd2ecb2099cba21bca3941ee4d655d2eb887b3a9
https://github.com/finos/git-proxy/releases/tag/v1.19.2
https://github.com/finos/git-proxy/security/advisories/GHSA-qr93-8wwf-22g4

Get alerted when CVE-2025-54583 or the next vulnerability affects your stack