Vulnerability · Published May 30, 2025 · Assigned by GitHub_M
CVE-2025-48938Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server
Low 2.6
In plain English
A low-severity security flaw in go-gh from cli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-cli-go-gh | no fix listed | DEBIAN-CVE-2025-48938 |
| Debian:13 | golang-github-cli-go-gh | no fix listed | DEBIAN-CVE-2025-48938 |
| Debian:13 | golang-github-cli-go-gh-v2 | no fix listed | DEBIAN-CVE-2025-48938 |
| Debian:14 | golang-github-cli-go-gh-v2 | no fix listed | DEBIAN-CVE-2025-48938 |
| Go | github.com/cli/go-gh/v2 | 2.12.1 | GHSA-g9f5-x53j-h563 |
| Go | github.com/cli/go-gh/v2 | 2.12.1 | GO-2025-3732 |
| Ubuntu:24.04:LTS | golang-github-cli-go-gh | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:25.10 | golang-github-cli-go-gh | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:26.04:LTS | golang-github-cli-go-gh | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:26.10 | golang-github-cli-go-gh | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:25.10 | golang-github-cli-go-gh-v2 | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:26.04:LTS | golang-github-cli-go-gh-v2 | no fix listed | UBUNTU-CVE-2025-48938 |
| Ubuntu:26.10 | golang-github-cli-go-gh-v2 | no fix listed | UBUNTU-CVE-2025-48938 |
Affected products (as reported)
Weakness: CWE-501 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U