The vulnerability of the gettreesha() function in the Docker Registrator’s automatic registration tool allows a attacker to execute arbitrary code.

The vulnerability of the gettreesha function in the Docker Registrator’s automatic registration tool is related to the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

JLSEC-2025-4 Argument injection in `gettreesha()` function in Registrator.jl

Impact If the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities, an argument injection is possible in the gettreesha function. This can then lead to a potential RCE. Patches Users should upgrade immediately to v1.9.5. All prior versions are vulnerable...

CVE-2025-52480: Improper Neutralization of Argument Delimiters in a Command

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities, an argument injection is possible in the...

CVE-2025-52483: Improper Neutralization of Special Elements used in a Command

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious or can be injected using upstream vulnerabilities a shell script injection can occur within the...