CVE-2025-54584: GitProxy Vulnerability in PACK File Parsing
Summary
CVE-2025-54584: GitProxy Backfile Parsing Exploit. Affects @finos/git-proxy versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finos/git-proxy package is a tool that facilitates Git operations while enforcing policies to prevent unapproved changes. It is designed to enhance security in Git workflows by ensuring that only validated commits are pushed to repositories. However, a vulnerability in its PACK file parsing mechanism allows attackers to exploit the system, potentially bypassing these security measures.
Vulnerability Detail
The vulnerability arises from the way the parsePush.ts file identifies the start of a Git PACK file by searching for the last occurrence of the string 'PACK' in the incoming push payload. This method is flawed because Git objects can contain arbitrary content, including the word 'PACK'. An attacker can craft a malicious Git packfile that embeds a misleading PACK signature within commit content, tricking the parser into treating invalid data as the actual packfile. This could allow attackers to hide commits from scanning or approval processes, leading to the insertion of unwanted or malicious code into repositories protected by GitProxy.
How To Fix
Minimum fixed version
1.19.2
This is the first release that contains the fix.
npm install @finos/git-proxy@1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement stricter validation checks on incoming push payloads to ensure that any unexpected data is flagged and rejected. This may involve custom scripting or additional middleware to inspect the payload before it reaches the GitProxy.
Conclusion
The CVE-2025-54584 vulnerability in the @finos/git-proxy package poses significant risks to Git workflows by allowing attackers to exploit PACK file parsing. It is crucial for users to update to the patched version 1.19.2 to safeguard their repositories. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @finos/git-proxy →
FAQ
CVE-2025-54584 is a vulnerability in the @finos/git-proxy package that allows attackers to exploit the PACK file parsing mechanism, potentially bypassing security policies.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without any signup.
The risks include the potential for attackers to hide malicious commits, bypass approval processes, and insert unwanted code into repositories, compromising the integrity of the codebase.
Yes, a patch is available in version 1.19.2 of the @finos/git-proxy package. It is recommended to update to this version or later.
If immediate updates are not possible, implement stricter validation checks on incoming push payloads as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @finos/git-proxy.
