Arbitrary Command Execution Vulnerability in go-gh by GitHub
CVE-2025-48938
2.6LOW
What is CVE-2025-48938?
A vulnerability has been found in go-gh, a set of Go modules for creating GitHub CLI extensions, affecting versions before 2.12.1. This flaw allows an attacker with control over a GitHub Enterprise Server to manipulate HTTP URLs, potentially leading to the execution of arbitrary commands on a user's machine by substituting these URLs with local file paths. To mitigate this risk, users are recommended to upgrade to version 2.12.1, which includes enhancements to the Browser.Browse() function aimed at preventing unauthorized file access while maintaining functionality for HTTP URLs.
Affected Version(s)
go-gh < 2.12.1