https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 10:35:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-248756 EUVD-2026-248756 https://cve.radiocsirt.org/vuln/euvd-2026-248756 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54584 <p>GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.</p> <p>GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54584 https://cve.radiocsirt.org/vuln/ghsa-xxmh-rf63-qwjv <p><strong>Affected:</strong> npm: @finos/git-proxy</p> <p>### Summary An attacker can craft a malicious Git packfile to exploit the PACK signature detection in the `parsePush.ts`. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits.</p> <p>### Details The affected version of `parsePush.ts` attempts to locate the Git PACK file by looking for the last occurrence of the string &#34;PACK&#34; in the incoming push payload:</p> <p>```ts const packStart = buffer.lastIndexOf(&#39;PACK&#39;); ```</p> <p>This assumes that any &#34;PACK&#34; string near the end of the push is the beginning of the actual binary Git packfile. However, Git objects (commits, blobs, etc.) can contain arbitrary content (including the word PACK) in binary or non-compressed blobs.</p> <p>An attacker could abuse this by: 1. Crafting a custom packfile using low-level Git tools or by manually forging one 2. Placing the string &#34;PACK&#34; inside a commit body or a binary file blob that appears after the real PACK start in the stream.</p> <p>The parser then ignores the actual push and treats the binary blob/commit body as the PACK file. The actual push contents may violate existing push policies.</p> <p>### PoC</p> <p>1. Make a commit on any branch (example: `test-branch`) containing the string &#34;PACK&#34; 2. Manually generate a custom packfile with both branches using `git pack-objects` or a low-level library/custom script: a) A…</p> <p><strong>Affected:</strong> npm: @finos/git-proxy</p> <p>### Summary An attacker can craft a malicious Git packfile to exploit the PACK signature detection in the `parsePush.ts`. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits.</p> <p>### Details The affected version of `parsePush.ts` attempts to locate the Git PACK file by looking for the last occurrence of the string &#34;PACK&#34; in the incoming push payload:</p> <p>```ts const packStart = buffer.lastIndexOf(&#39;PACK&#39;); ```</p> <p>This assumes that any &#34;PACK&#34; string near the end of the push is the beginning of the actual binary Git packfile. However, Git objects (commits, blobs, etc.) can contain arbitrary content (including the word PACK) in binary or non-compressed blobs.</p> <p>An attacker could abuse this by: 1. Crafting a custom packfile using low-level Git tools or by manually forging one 2. Placing the string &#34;PACK&#34; inside a commit body or a binary file blob that appears after the real PACK start in the stream.</p> <p>The parser then ignores the actual push and treats the binary blob/commit body as the PACK file. The actual push contents may violate existing push policies.</p> <p>### PoC</p> <p>1. Make a commit on any branch (example: `test-branch`) containing the string &#34;PACK&#34; 2. Manually generate a custom packfile with both branches using `git pack-objects` or a low-level library/custom script: a) A…</p> https://cve.radiocsirt.org/vuln/ghsa-xxmh-rf63-qwjv