CVE-2025-48938: Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

May 30, 2025 (updated June 4, 2025)

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user’s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

References

github.com/advisories/GHSA-g9f5-x53j-h563
github.com/cli/go-gh
github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
nvd.nist.gov/vuln/detail/CVE-2025-48938

Code Behaviors & Features

Detect and mitigate CVE-2025-48938 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →