CVE-2025-54585: @finos/git-proxy New Branch Approval Bypass Vulnerability
Summary
CVE-2025-54585: GitProxy New Branch Approval Exploit. Affects @finos/git-proxy versions < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finos/git-proxy package is a tool designed to manage Git repository interactions, particularly focusing on enforcing approval policies for commit pushes. It allows organizations to maintain control over code changes by requiring explicit approvals before commits are pushed to branches. However, a flaw in its handling of new branch creation can lead to unauthorized commits being pushed without proper approval.
Vulnerability Detail
The vulnerability arises from the way GitProxy identifies new branches using a specific hash value. An attacker can exploit this by creating a new branch from an unapproved commit and then pushing that commit to the remote repository without any checks. This can lead to unapproved changes being integrated into the codebase, undermining the integrity of the version control process. The issue is particularly concerning as it requires no elevated privileges and can be executed by any user with push access.
How To Fix
Latest published version: 2.3.0 as of 23 Oct 2026
npm install @finos/git-proxy@2.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.2
This is the first release that contains the fix.
npm install @finos/git-proxy@1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all users are aware of the need to approve commits on the main branch before creating new branches. Additionally, GitProxy administrators can manually monitor branch activities to prevent unapproved commits from being pushed.
Conclusion
The CVE-2025-54585 vulnerability in the @finos/git-proxy package poses a significant risk by allowing unapproved commits to be pushed to remote repositories. It is crucial for users to update to version 1.19.2 or later to secure their systems and maintain code integrity.
See every vulnerability recorded for @finos/git-proxy →
FAQ
CVE-2025-54585 is a vulnerability in the @finos/git-proxy package that allows unapproved commits to be pushed to a remote repository by exploiting the new branch creation process.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to unauthorized changes being integrated into the codebase, potentially compromising the integrity and security of the software.
Yes, the patch is available in version 1.19.2 of the @finos/git-proxy package. Users should update to this version to mitigate the vulnerability.
If an immediate update is not possible, ensure strict monitoring of branch activities and enforce manual approval processes for commits until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for @finos/git-proxy.
