https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:37:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-242245 EUVD-2026-242245 https://cve.radiocsirt.org/vuln/euvd-2026-242245 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48938 <p>go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.</p> <p>go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48938 https://cve.radiocsirt.org/vuln/ghsa-g9f5-x53j-h563 <p><strong>Affected:</strong> Go: github.com/cli/go-gh/v2</p> <p>### Summary</p> <p>A security vulnerability has been identified in `go-gh` where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.</p> <p>### Details</p> <p>The GitHub CLI and CLI extensions allow users to transition from their terminal for a variety of use cases through the [`Browser` capability in `github.com/cli/go-gh/v2/pkg/browser`](https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go):</p> <p>- Using the `-w, --web` flag, GitHub CLI users can view GitHub repositories, issues, pull requests, and more using their web browser - Using the `gh codespace` command set, GitHub CLI users can transition to Visual Studio Code to work with GitHub Codespaces</p> <p>This is done by using URLs provided through API responses from authenticated GitHub hosts when users execute `gh` commands.</p> <p>Prior to `2.12.1`, `Browser.Browse()` would attempt to open the provided URL using a variety of OS-specific approaches regardless of the scheme. An attacker-controlled GitHub Enterprise Server could modify API responses to use a specially tailored local executable path instead of HTTP URLs to resources. This could allow the attacker to execute arbitrary executables on the user&#39;s machine.</p> <p>In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem withou…</p> <p><strong>Affected:</strong> Go: github.com/cli/go-gh/v2</p> <p>### Summary</p> <p>A security vulnerability has been identified in `go-gh` where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.</p> <p>### Details</p> <p>The GitHub CLI and CLI extensions allow users to transition from their terminal for a variety of use cases through the [`Browser` capability in `github.com/cli/go-gh/v2/pkg/browser`](https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go):</p> <p>- Using the `-w, --web` flag, GitHub CLI users can view GitHub repositories, issues, pull requests, and more using their web browser - Using the `gh codespace` command set, GitHub CLI users can transition to Visual Studio Code to work with GitHub Codespaces</p> <p>This is done by using URLs provided through API responses from authenticated GitHub hosts when users execute `gh` commands.</p> <p>Prior to `2.12.1`, `Browser.Browse()` would attempt to open the provided URL using a variety of OS-specific approaches regardless of the scheme. An attacker-controlled GitHub Enterprise Server could modify API responses to use a specially tailored local executable path instead of HTTP URLs to resources. This could allow the attacker to execute arbitrary executables on the user&#39;s machine.</p> <p>In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem withou…</p> https://cve.radiocsirt.org/vuln/ghsa-g9f5-x53j-h563 https://cve.radiocsirt.org/vuln/msrc_cve-2025-48938 msrc_CVE-2025-48938 https://cve.radiocsirt.org/vuln/msrc_cve-2025-48938 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15225-1 <p>govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15225-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-48938 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-cli-go-gh, Ubuntu:Pro:24.04:LTS: golang-github-cli-go-gh-v2, Ubuntu:25.10: golang-github-cli-go-gh, Ubuntu:25.10: golang-github-cli-go-gh-v2, Ubuntu:26.04:LTS: golang-github-cli-go-gh, Ubuntu:26.04:LTS: golang-github-cli-go-gh-v2</p> <p>go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-cli-go-gh, Ubuntu:Pro:24.04:LTS: golang-github-cli-go-gh-v2, Ubuntu:25.10: golang-github-cli-go-gh, Ubuntu:25.10: golang-github-cli-go-gh-v2, Ubuntu:26.04:LTS: golang-github-cli-go-gh, Ubuntu:26.04:LTS: golang-github-cli-go-gh-v2</p> <p>go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user&#39;s machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-48938