Go/github.com/cli/go-gh/v2 CVE-2025-48938: critical 9.8, EPSS 0.56%
GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh
Action: Upgrade github.com/cli/go-gh/v2 to 2.12.1 or later.
go get github.com/cli/go-gh/v2@v2.12.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.12.1 | - |
Fixed versions
| 2.12.1 |
Sources
- osv: GO-2025-3732
- nvd: CVE-2025-48938
- https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
- https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
CVE-2025-48938 · published · modified · JSON