Skip to content
OpenAdvisories
Low · 2.6 CVE-2025-48938 EUVD-2025-16493GHSA-g9f5-x53j-h563GO-2025-3732

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Published May 30, 2025 · Updated May 30, 2025 · Assigned by GitHub_M

Description

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.

Affected products

VendorProductAffectedFixed
cli go-gh < 2.12.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-cli-go-gh-v2 No fix yet —
Debian 13 golang-github-cli-go-gh +1 No fix yet —
Debian 12 golang-github-cli-go-gh No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-cli-go-gh +1 No fix yet —
Ubuntu 26.04 LTS golang-github-cli-go-gh +1 No fix yet —
Ubuntu 25.10 golang-github-cli-go-gh +1 No fix yet —
Ubuntu 24.04 LTS golang-github-cli-go-gh No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS golang-github-cli-go-gh-v2 No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250612T141001-1.1 openSUSE-SU-2025:15225-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gh 2.62.0-9 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling wolfictl 0.37.2-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cli/go-gh/v2 < 2.12.1 2.12.1 GHSA-g9f5-x53j-h563

Advisories 1

References