CVE-2025-52480: Registrator.jl Argument Injection Vulnerability
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the gettreesha() function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52480?
CVE-2025-52480 has a critical severity level due to the potential for argument injection if malicious clone URLs are returned.
How do I fix CVE-2025-52480?
To fix CVE-2025-52480, upgrade to Registrator version 1.9.5 or later, which includes the necessary security patches.
What types of vulnerabilities are associated with CVE-2025-52480?
CVE-2025-52480 is associated with argument injection vulnerabilities caused by malicious clone URLs.
Which versions of Registrator are affected by CVE-2025-52480?
Versions of Registrator prior to 1.9.5 are affected by CVE-2025-52480.
What should users do if they cannot upgrade to the patched version of Registrator for CVE-2025-52480?
If users cannot upgrade, they should implement additional security measures to verify the authenticity of clone URLs before use.