Arbitrary Command Execution Vulnerability in golang-github-cli-go-gh Package

golang-github-cli-go-gh Updated 02 Oct 2025

Summary

30/05/2025

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2025-48938: go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. Affects golang-github-cli-go-gh versions < a08820a13f257d6c5b4cb86d37db559ec6d14577. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The golang-github-cli-go-gh package is a collection of Go modules designed to simplify the process of authoring GitHub CLI extensions. It provides developers with tools to interact with GitHub's API and manage repositories efficiently. However, a critical vulnerability has been identified that exposes users to potential security risks when interacting with GitHub Enterprise Servers.

Vulnerability Detail

A security vulnerability exists in versions prior to 2.12.1 of the golang-github-cli-go-gh package. An attacker-controlled GitHub Enterprise Server can manipulate HTTP URLs provided by GitHub, replacing them with local file paths. This could lead to the execution of arbitrary commands on a user's machine, posing significant security risks. The vulnerability arises from insufficient validation of URLs, allowing malicious actors to exploit the system.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

Currently, there are no known workarounds other than upgrading to the patched version of the package.

Conclusion

The golang-github-cli-go-gh package has a critical vulnerability that allows for arbitrary command execution due to improper URL validation. Users are strongly advised to upgrade to version 2.12.1 or later to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.

See every vulnerability recorded for golang-github-cli-go-gh →