CVE-2025-48938 Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938 Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938 Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Summary A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. Details The GitHub CLI and CLI...

GHSA-G9F5-X53J-H563 Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Summary A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. Details The GitHub CLI and CLI...

go-gh security vulnerabilities

go-gh is a collection of Go modules open sourced from the GitHub CLI. It is used to interact with gh and GitHub APIs from the command line. A security vulnerability exists in go-gh versions prior to 2.12.1, which stems from an attacker-controlled GitHub Enterprise Server could lead to the executi...

OS Command Injection

LLama-Index CLI is vulnerable to OS Command Injection. The vulnerability is due to improper input handling due to unsanitized use of the --files argument passed directly into os.system, allowing arbitrary command execution...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: OSV:GHSA-G99H-56MW-8263...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: GHSA-G99H-56MW-8263...

LLama-Index CLI OS command injection vulnerability

LLama-Index CLI prior to v0.4.1, corresponding to LLama-Index prior to v0.12.21, contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this...

CVE-2025-1753

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

PYSEC-2025-246

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: MEND:CVE-2025-1753...

CVE-2025-1753 Command Injection in LLama-Index CLI in run-llama/llama_index

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: SNYK:PYTHON-LLAMAINDEXCLI-10265935...

CVE-2025-1753

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the "--files" argument, which is directly passed into "os.system". An attacker who controls the content of this argument can inject and execute arbitrary shell...

CVE-2025-1753 Command Injection in LLama-Index CLI in run-llama/llama_index

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

Command Injection

Overview llama-index-cli is a llama-index cli Affected versions of this package are vulnerable to Command Injection through the CLI interface due to pasting the --files argument directly into os.system. An attacker who controls the content of this argument can execute arbitrary commands on the...

CVE-2025-1753

CVE-2025-1753 affects the LLama-Index CLI version v0.12.20. The vulnerability stems from the improper handling of the --files argument, which is directly passed into os.system, enabling an attacker who controls the content of this argument to inject and execute arbitrary shell commands. Impact ca...