PT-2025-23335 · Go-Gh+1 · Go-Gh+1

Matt- · Published 2025-05-30 · Updated 2025-10-15 · CVE-2025-48938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions go-gh versions prior to 2.12.1

Description A security issue has been identified where an attacker-controlled GitHub Enterprise Server could execute arbitrary commands on a user's machine. This is achieved by replacing HTTP URLs provided by GitHub with local file paths for browsing. The Browser.Browse() function has been enhanced in version 2.12.1 to prevent opening or executing files on the filesystem without impacting HTTP URLs.

Recommendations For versions prior to 2.12.1, upgrade to version 2.12.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Browser.Browse() function until a patch is available. Avoid using the Browser.Browse() function with untrusted GitHub Enterprise Server URLs to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-501

Related Identifiers

AZL-62282

CVE-2025-48938

GHSA-G9F5-X53J-H563

GO-2025-3732

OPENSUSE-SU-2025:15225-1

Affected Products

Debian

Go-Gh

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48938.json · Exploit
• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563 · Vendor Advisory
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577 · Patch
• https://ubuntu.com/security/CVE-2025-48938 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g9f5-x53j-h563 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48938 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-62282 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-48938 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3732 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-48938 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-48938 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48938 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-48938 · Vendor Advisory
• https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go · Note