Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-52483

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.

Published

2025-06-25T17:15:38.740

Last Modified

2025-09-19T16:01:28.570

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-77
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application julialang registrator < 1.9.5 Yes
References