Argument Injection Vulnerability in Registrator GitHub App by Julia
CVE-2025-52480

8.1HIGH

Key Information:

Vendor

Juliaregistries

Status
Registrator.jl
Vendor
CVE Published:
25 June 2025

What is CVE-2025-52480?

Prior to version 1.9.5, Registrator, a GitHub app designed for automating registration pull requests for Julia packages, is vulnerable to an argument injection issue. This vulnerability arises when a malicious or compromised clone URL is returned by GitHub, potentially enabling an attacker to manipulate the gettreesha() function. Such manipulation could lead to remote code execution, posing significant security risks. It is crucial for users to upgrade to version 1.9.5 or later to eliminate this risk, as no effective workarounds currently exist.

Affected Version(s)

Registrator.jl < 1.9.5

References

https://github.com/JuliaRegistries/Registrator.jl/securit...
x_refsource_CONFIRM
https://github.com/JuliaRegistries/Registrator.jl/pull/449
x_refsource_MISC

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52480 : Argument Injection Vulnerability in Registrator GitHub App by Julia