EUVD-2026-248754

fkie_cve-2025-54583

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.

GHSA-qr93-8wwf-22g4 — GitProxy Approval Bypass When Pushing Multiple Branches

Affected: npm: @finos/git-proxy

### Summary This vulnerability allows a user to push to the remote repository while bypassing policies and explicit approval. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository.

Because it can allow policy violations to go undetected, we classify this as a High impact vulnerability.

### Details The source of the vulnerability is the push parser action `parsePush.ts`. It reads the first branch and parses it, while ignoring subsequent branches (silently letting them go through).

Although the fix involves multiple improvements to the commit and push parsing logic, the core solution is to prevent multiple branch pushes from going through in the first place:

```ts if (refUpdates.length !== 1) { step.log('Invalid number of branch updates.'); step.log(`Expected 1, but got ${refUpdates.length}`); step.setError('Your push has been blocked. Please make sure you are pushing to a single branch.'); action.addStep(step); return action; } ```

### PoC

1. Make a commit on a branch:

```bash git checkout -b safe-branch echo "Approved code" > file.txt git add . git commit -m "Approved code" git push proxy safe-branch ```

2. Wait for approval of `safe-branch`.

3. Make a commit on a separate branch with a secret, for example:

```bash git checkout -b bad-branch echo "SECRET=abc123" > .env git add . git commit -m "Bad code" ```

4. Push both at the same time:

`git push proxy safe-branch bad-branch`

#### Expected…

Most recent entries from all

EUVD-2026-248754

fkie_cve-2025-54583

GHSA-qr93-8wwf-22g4 — GitProxy Approval Bypass When Pushing Multiple Branches