CVE-2025-48938
go-gh is a collection of Go modules to make authoring GitHub CLI exten ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Azure Linux (baja).
Descripción
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | gh | 0:2.62.0-9.azl3 |
| chainguard | wolfictl | 0.37.2-r1 |
| debian 12 | golang-github-cli-go-gh | sin corrección indicada |
| debian 13 | golang-github-cli-go-gh, golang-github-cli-go-gh-v2 | sin corrección indicada |
| debian 14 | golang-github-cli-go-gh-v2 | sin corrección indicada |
| echo | golang-github-cli-go-gh, golang-github-cli-go-gh-v2 | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/cli/go-gh/v2 | 2.12.1 |
| rapidfort debian 12 | golang-github-cli-go-gh, golang-github-cli-go-gh-v2 | sin corrección indicada |
| rapidfort debian 13 | golang-github-cli-go-gh, golang-github-cli-go-gh-v2 | sin corrección indicada |
| wolfi | wolfictl | 0.37.2-r1 |
Mostrar las 14 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | gh | 0:2.62.0-9.azl3 |
| chainguard | wolfictl | 0.37.2-r1 |
| debian 12 | golang-github-cli-go-gh | sin corrección indicada |
| debian 13 | golang-github-cli-go-gh | sin corrección indicada |
| debian 13 | golang-github-cli-go-gh-v2 | sin corrección indicada |
| debian 14 | golang-github-cli-go-gh-v2 | sin corrección indicada |
| echo | golang-github-cli-go-gh | sin corrección indicada |
| echo | golang-github-cli-go-gh-v2 | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/cli/go-gh/v2 | 2.12.1 |
| rapidfort debian 12 | golang-github-cli-go-gh | sin corrección indicada |
| rapidfort debian 12 | golang-github-cli-go-gh-v2 | sin corrección indicada |
| rapidfort debian 13 | golang-github-cli-go-gh | sin corrección indicada |
| rapidfort debian 13 | golang-github-cli-go-gh-v2 | sin corrección indicada |
| wolfi | wolfictl | 0.37.2-r1 |
Referencias
- https://github.com/cli/go-gh
- https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go
- https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
- https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
- https://nvd.nist.gov/vuln/detail/CVE-2025-48938