EUVD-2025-19118
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.
Analysis
Registrator, a GitHub app automating Julia package registration, contains critical shell injection and argument injection vulnerabilities in versions prior to 1.9.5 that can be exploited through malicious or injected clone URLs returned by GitHub. An unauthenticated remote attacker can achieve arbitrary code execution on systems running vulnerable versions with no user interaction required. No public exploits are confirmed, but the vulnerability is trivial to exploit given the direct code paths involved.
Technical Context
Registrator is a GitHub automation application written in Julia that processes package registration workflows. The vulnerability exists in two distinct code paths: (1) the `withpasswd` function which appears to construct shell commands using unsanitized clone URLs returned by the GitHub API, and (2) the `gettreesha` function which is vulnerable to command argument injection. Both vulnerabilities fall under CWE-77 (Improper Neutralization of Special Elements used in a Command), a class covering shell metacharacter injection and argument injection attacks. The root cause is the lack of proper input validation and sanitization when constructing system commands from external data (GitHub API responses). The attack surface is the GitHub API integration layer, where clone URLs are processed without escaping shell-dangerous characters or using safe command execution APIs.
Affected Products
Registrator (All versions prior to 1.9.5)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today