Read the docs
TI-2025-31076 Aliases CVE-2025-48938GHSA-g9f5-x53j-h563

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Priority LOW 14CWE-501Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00564 47th percentileScored 2026-11-07
Fix Fixed go-gh (cli): 2.12.1github.com/cli/go-gh/v2 (Go): 2.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cligo-ghbefore 2.12.12.12.1Patch availableCNA
—github.com/cli/go-gh/v2 (Go)before 2.12.12.12.1Patch availableGHSA-g9f5-x53j-h563
  • go-gh Vendorcli Affected before 2.12.1 Fixed in 2.12.1 Patch available CNA
  • github.com/cli/go-gh/v2 (Go) Vendor— Affected before 2.12.1 Fixed in 2.12.1 Patch available GHSA-g9f5-x53j-h563

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cli:go-gh:*:*:*:*:*:go:*:*before 2.12.1Vulnerablecli
  • cpe:2.3:a:cli:go-gh:*:*:*:*:*:go:*:* Versions before 2.12.1 Vulnerable ·cli

Remediation

  • Fix · CNA go-gh (cli) Fixed in 2.12.1
  • Fix · GHSA-g9f5-x53j-h563 github.com/cli/go-gh/v2 (Go) Fixed in 2.12.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48938
  2. 2026-10-03 Alias added: GHSA-g9f5-x53j-h563

References

Patch 1

Advisory 2

Other 2

  • TI-2024-36052 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences