What is the CVSS score of CVE-2025-52483?

CVE-2025-52483 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Github are affected by CVE-2025-52483?

A critical vulnerability in Registrator (GitHub app for Julia package registry automation) allows remote code execution if malicious clone URLs are processed.. A patch is available.

How to fix or mitigate CVE-2025-52483?

Within 24 hours: Identify all systems running Registrator and audit recent pull request activity for suspicious behavior. Within 7 days: Upgrade all Registrator instances to version 1.9.5 and validate successful deployment. Within 30 days: Conduct forensic review of logs for exploitation attempts and assess whether any package registrations were compromised during vulnerable periods.

Github CVE-2025-52483

EUVD-2025-19118 CRITICAL

Command Injection (CWE-77)

2025-06-25 security-advisories@github.com

Command Injection RCE Code Injection Github Python Registrator

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19118

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

Patch released

Mar 15, 2026 - 23:19 nvd

Patch available

CVE Published

Jun 25, 2025 - 17:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the withpasswd function. Alternatively, an argument injection is possible in the gettreesha function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.

AnalysisAI

Registrator, a GitHub app automating Julia package registration, contains critical shell injection and argument injection vulnerabilities in versions prior to 1.9.5 that can be exploited through malicious or injected clone URLs returned by GitHub. An unauthenticated remote attacker can achieve arbitrary code execution on systems running vulnerable versions with no user interaction required. No public exploits are confirmed, but the vulnerability is trivial to exploit given the direct code paths involved.

Technical ContextAI

Registrator is a GitHub automation application written in Julia that processes package registration workflows. The vulnerability exists in two distinct code paths: (1) the withpasswd function which appears to construct shell commands using unsanitized clone URLs returned by the GitHub API, and (2) the gettreesha function which is vulnerable to command argument injection. Both vulnerabilities fall under CWE-77 (Improper Neutralization of Special Elements used in a Command), a class covering shell metacharacter injection and argument injection attacks. The root cause is the lack of proper input validation and sanitization when constructing system commands from external data (GitHub API responses). The attack surface is the GitHub API integration layer, where clone URLs are processed without escaping shell-dangerous characters or using safe command execution APIs.