Registrator
Monthly
Registrator, a GitHub app automating Julia package registration, contains critical shell injection and argument injection vulnerabilities in versions prior to 1.9.5 that can be exploited through malicious or injected clone URLs returned by GitHub. An unauthenticated remote attacker can achieve arbitrary code execution on systems running vulnerable versions with no user interaction required. No public exploits are confirmed, but the vulnerability is trivial to exploit given the direct code paths involved.
Registrator, a GitHub app automating Julia package registrations, contains an argument injection vulnerability in the gettreesha() function that can be exploited via malicious clone URLs to achieve remote code execution. All versions prior to 1.9.5 are vulnerable; the vulnerability requires no user interaction or privileges and can be triggered remotely over the network. While no active exploitation or public POC has been confirmed in the provided data, the critical nature of RCE capability and the complete lack of workarounds make immediate patching essential for all Registrator deployments.
Registrator, a GitHub app automating Julia package registration, contains critical shell injection and argument injection vulnerabilities in versions prior to 1.9.5 that can be exploited through malicious or injected clone URLs returned by GitHub. An unauthenticated remote attacker can achieve arbitrary code execution on systems running vulnerable versions with no user interaction required. No public exploits are confirmed, but the vulnerability is trivial to exploit given the direct code paths involved.
Registrator, a GitHub app automating Julia package registrations, contains an argument injection vulnerability in the gettreesha() function that can be exploited via malicious clone URLs to achieve remote code execution. All versions prior to 1.9.5 are vulnerable; the vulnerability requires no user interaction or privileges and can be triggered remotely over the network. While no active exploitation or public POC has been confirmed in the provided data, the critical nature of RCE capability and the complete lack of workarounds make immediate patching essential for all Registrator deployments.