CVE-2025-54583: @finos/git-proxy Approval Bypass Vulnerability
Summary
CVE-2025-54583: GitProxy Approval Bypass When Pushing Multiple Branches. Affects @finos/git-proxy versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finos/git-proxy package is designed to enforce policies and approvals for Git repository pushes, ensuring that only approved changes are made to the codebase. It acts as a proxy to manage push requests, providing an additional layer of security for organizations relying on Git for version control. However, a vulnerability has been identified that allows users to bypass these approval mechanisms when pushing multiple branches simultaneously.
Vulnerability Detail
This vulnerability allows a user to push to the remote repository while bypassing policies and explicit approval. The issue originates from the push parser action 'parsePush.ts', which only reads the first branch and ignores subsequent branches, allowing them to be pushed without checks. This can lead to unauthorized code changes, including the introduction of secrets or malicious code, as the system fails to enforce necessary review policies. The vulnerability is classified as high impact due to its potential to allow policy violations to go undetected.
How To Fix
Minimum fixed version
1.19.2
This is the first release that contains the fix.
npm install @finos/git-proxy@1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid pushing multiple branches at the same time. Ensure that only one branch is pushed per request to maintain the integrity of the approval process. For example, use the following command to push a single branch: git push proxy safe-branch.
Conclusion
The CVE-2025-54583 vulnerability in the @finos/git-proxy package poses a significant risk by allowing users to bypass approval processes when pushing multiple branches. It is crucial for users to update to the patched version to secure their repositories and prevent unauthorized changes.
See every vulnerability recorded for @finos/git-proxy →
FAQ
CVE-2025-54583 is a vulnerability in the @finos/git-proxy package that allows users to bypass approval processes when pushing multiple branches to a Git repository.
This vulnerability can lead to unauthorized code changes being pushed to your repository, potentially introducing malicious code or secrets without proper review.
If you are using a version of @finos/git-proxy that is 1.19.1 or lower, you should update to version 1.19.2 or later to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Vulert is a tool that monitors open-source vulnerabilities using just the package-lock.json file, providing real-time alerts for any issues found in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for @finos/git-proxy.
