CVE-2025-48938

CriticalCVSS 9.8/10Last modified Aug 17, 2026

Description

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-501

Affected software

VendorProductVersions
cligo-gh< 2.12.1

References

Timeline

Published
May 30, 2025
Last modified
Aug 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-489394.2tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js whCVE-2025-48945.9A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulneCVE-2025-489407.2MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allCVE-2025-489415.3MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which alCVE-2025-489426.5vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/compCVE-2025-489436.5vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (CVE-2025-489446.5vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used CVE-2025-489458.2pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynCVE-2025-489463.7liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version CVE-2025-489477.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 throughCVE-2025-489486.5Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allowCVE-2025-489499.8Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to impro