-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @finos/git-proxy | npm | <= 1.19.1 | 1.19.2 |
Miggo AIRoot Cause AnalysisThe vulnerability allows bypassing security checks by pushing multiple branches at once. The provided patch for commit a620a2f33c39c78e01783a274580bf822af3cc3a clearly shows that the exec function within src/proxy/processors/push-action/parsePush.ts was modified to prevent this. The core of the fix is the introduction of a check that explicitly validates the number of branch updates in a push and rejects any push with more than one. The vulnerable function is identified as parsePush.exec because its displayName is set to this value, and it is the entry point for parsing the push request where the multi-branch bypass occurs. The previous implementation incorrectly parsed the push data, only considering the first branch and ignoring any others, which is the root cause of the vulnerability.
JavaScriptJavaScriptThe vulnerability impacts all users or organizations relying on GitProxy to enforce policies and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve the first push. It is much more likely that a well-meaning user would trigger this accidentally.
Ongoing coverage of React2Shell