CVE-2025-54586: @finos/git-proxy High-Impact Hidden Commits Injection Vulnerability
Summary
CVE-2025-54586: GitProxy Hidden Commits Injection. Affects @finos/git-proxy versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finos/git-proxy package is a tool designed to facilitate the interaction between Git clients and GitHub repositories by acting as a proxy. It allows users to push and pull code while managing access and permissions. However, a critical vulnerability has been identified that compromises the confidentiality of repositories by allowing unauthorized data injection through hidden commits.
Vulnerability Detail
The vulnerability arises from the proxy's trust in the ref-update line without inspecting the contents of the packfile. This oversight allows an attacker to inject additional, unreferenced commits into the repository. These 'hidden' commits can contain sensitive information and are accessible via their direct commit URLs, posing a significant risk of data exfiltration without detection. The vulnerability is rated with a CVSS score of 7.1, indicating a high level of severity due to its potential impact on repository confidentiality.
How To Fix
Minimum fixed version
1.19.2
This is the first release that contains the fix.
npm install @finos/git-proxy@1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the git-proxy for sensitive operations until the package is updated. Additionally, ensure that only trusted clients are allowed to push to repositories to mitigate the risk of hidden commits.
Conclusion
The CVE-2025-54586 vulnerability in the @finos/git-proxy package poses a serious risk to repository confidentiality by allowing hidden commits to be injected. Users are strongly advised to update to version 1.19.2 or later to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for @finos/git-proxy →
FAQ
CVE-2025-54586 is a high-impact vulnerability in the @finos/git-proxy package that allows attackers to inject hidden commits into GitHub repositories, compromising data confidentiality.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including CVE-2025-54586.
Hidden commits are commits that are not referenced by any branch in a Git repository but can still be accessed via their commit SHA. This vulnerability allows attackers to inject such commits without detection.
If immediate updates are not possible, restrict access to your repositories and avoid using the git-proxy for sensitive operations until the vulnerability is patched.
The CVSS score of this vulnerability is 7.1, indicating a high severity level due to the potential for significant data exfiltration.
References
Related vulnerabilities
Recent vulnerabilities recorded for @finos/git-proxy.
