CVE-2025-52483: Registrator.jl Vulnerable to Argument Injection and Command Injection
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the withpasswd function. Alternatively, an argument injection is possible in the gettreesha function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52483?
CVE-2025-52483 has a high severity due to the potential for shell script injection vulnerabilities.
How do I fix CVE-2025-52483?
To fix CVE-2025-52483, upgrade the GitHub Registrator to version 1.9.5 or later.
Who is affected by CVE-2025-52483?
CVE-2025-52483 affects users of GitHub Registrator versions prior to 1.9.5.
What type of vulnerability is CVE-2025-52483?
CVE-2025-52483 is a shell script injection vulnerability stemming from a manipulated clone URL.
Can CVE-2025-52483 be exploited remotely?
Yes, CVE-2025-52483 can be exploited remotely if a malicious clone URL is injected.