Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-48938 · CVE overview and exploitation status

EUVD-2025-16493

GHSA-g9f5-x53j-h563

GO-2025-3732

cve-program · CVE-2025-48938

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
• https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go

euvd · EUVD-2025-16493

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
• https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go

nvd · CVE-2025-48938

• https://github.com/cli/go-gh/blob/61bf393cf4aeea6d00a6251390f5f67f5b67e727/pkg/browser/browser.go
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563

osv · GHSA-g9f5-x53j-h563

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://nvd.nist.gov/vuln/detail/CVE-2025-48938
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
• https://github.com/cli/go-gh

osv · GO-2025-3732

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577

No related changes are available here.