{"cve":"CVE-2025-54586","nvd":{"published":"2025-07-30T22:15:25.120","modified":"2026-06-17T09:40:21.020","status":"Analyzed","description":"GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below,   attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110","https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a","https://github.com/finos/git-proxy/releases/tag/v1.19.2","https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g","https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g"],"products":["finos:gitproxy"],"source":"nvd","synced_at":"2026-10-19T22:05:46.678065081+00:00"},"epss":{"cve":"CVE-2025-54586","score":0.00413,"percentile":0.35663,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v98g-8rqx-g93g","url":"https://osv.dev/vulnerability/GHSA-v98g-8rqx-g93g","summary":"GitProxy Hidden Commits Injection","modified":"2025-07-31T12:02:22Z","packages":[{"ecosystem":"npm","name":"@finos/git-proxy","purl":"pkg:npm/%40finos/git-proxy","ranges":["<1.19.2"],"fixed":["1.19.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}