{"action":"Upgrade @finos/git-proxy to 1.19.2 or later.","affected":[{"fixed":"1.19.2","introduced":"0"}],"component":"@finos/git-proxy","cve_ids":["CVE-2025-54586"],"ecosystem":"npm","epss":0.00413,"exploited":false,"fixed_versions":["1.19.2"],"ghsa_id":"GHSA-v98g-8rqx-g93g","id":"tcs_01M5KGBCAGDWCXTX5ZKAJQYGHK","modified_at":"2025-07-31T12:02:22Z","published_at":"2025-07-30T16:40:40Z","references":["https://osv.dev/vulnerability/GHSA-v98g-8rqx-g93g","https://github.com/finos/git-proxy/security/advisories/GHSA-v98g-8rqx-g93g","https://nvd.nist.gov/vuln/detail/CVE-2025-54586","https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110","https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a","https://github.com/finos/git-proxy","https://github.com/finos/git-proxy/releases/tag/v1.19.2"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-v98g-8rqx-g93g","url":"https://osv.dev/vulnerability/GHSA-v98g-8rqx-g93g"}],"summary":"GitProxy Hidden Commits Injection"}