https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T13:48:57.611388+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-248816 EUVD-2026-248816 2026-10-05T13:48:57.661139+00:00 EUVD-2026-248816 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54586 fkie_cve-2025-54586 2026-10-05T13:48:57.661180+00:00

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.

 https://cve.radiocsirt.org/vuln/ghsa-v98g-8rqx-g93g GHSA-v98g-8rqx-g93g — GitProxy Hidden Commits Injection 2026-10-05T13:48:57.661218+00:00

Affected: npm: @finos/git-proxy

### Summary An attacker can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality.

### Details

The proxy currently trusts only the ref‑update line (`oldOid → newOid`) and doesn't inspect the packfile’s contents

Because the code only runs `git rev-list oldOid..newOid` to compute **introducedCommits** but **never** checks which commits actually arrived in the pack, a malicious client can append extra commits. Those “hidden” commits won’t be pointed to by any branch but GitHub still stores and serves them by SHA. <img width="2556" height="744" alt="Screenshot 2025-07-16 at 12 29 19" src="https://github.com/user-attachments/assets/abf459a9-310b-4819-a989-797c7e871790" />

### PoC

#### Prerequisites

- A GitHub Personal Access Token stored in `~/.github-test-pat`. - A test repository also registered in git-proxy, e.g. `your-org/test-repo.git`, to which you have push rights.

#### 1. Prepare the “visible” and “hidden” commits

```bash # Clone the test repository git clone http://localhost:8000/your-org/test-repo.git cd test-repo

# 1. Record the original HEAD ORIG_COMMIT=$(git rev-parse HEAD)

# 2. C…