PT-2025-35245

Name of the Vulnerable Software and Affected Versions: Gitpod versions prior to main-gha.33628 Description: Gitpod, a developer platform for cloud development environments, experienced an issue where OAuth integration with Bitbucket, under specific conditions, could expose a valid Bitbucket acces...

Linux Distros Unpatched Vulnerability : CVE-2025-48938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 whe...

PT-2025-37324

Name of the Vulnerable Software and Affected Versions: TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh version 2.0.0 Description: An issue allows a remote attacker to execute arbitrary code via the default password. Recommendations: Change the default password...

CVE-2025-48938 affecting package gh for versions less than 2.62.0-9

CVE-2025-48938 affecting package gh for versions less than 2.62.0-9. A patched version of the package is available...

CVE-2025-54956

The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request...

SUSE CVE-2025-54956

The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request...

CVE-2025-54956

The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request...

UBUNTU-CVE-2025-54956

The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request...

CVE-2025-54956

The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request...

RSEC-2025-0 Arbitrary Code Execution (ACE) Vulnerability

A bug was identified in releases of the GH R package prior to version 1.5. This flaw could expose sensitive information, such as authentication tokens, through request headers during its operation if responses were cached to disk. We issued a Posit Security Advisory with the 1.5 release and...

Fedora: Security Advisory (FEDORA-2025-164ac0d01f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : gh (2025-164ac0d01f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-164ac0d01f advisory. Update to 2.74.0 - Fixes CVE-2025-48938 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

DEBIAN-CVE-2025-48938

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

AZL-62282 CVE-2025-48938 affecting package gh for versions less than 2.62.0-9

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URL...

CVE-2025-48938

The CVE-2025-48938 issue affects go-gh (Go modules for GitHub CLI extensions). In affected versions before 2.12.1, an attacker-controlled GitHub Enterprise Server could cause arbitrary commands to run on a user’s machine by substituting HTTP URLs from GitHub with local file paths during browsing....

PT-2025-23335 · Go-Gh +1 · Go-Gh +1

Name of the Vulnerable Software and Affected Versions: go-gh versions prior to 2.12.1 Description: A security issue has been identified where an attacker-controlled GitHub Enterprise Server could execute arbitrary commands on a user's machine. This is achieved by replacing HTTP URLs provided by...

multicast in source builds from vulnerable setuptools dependency

Impact Some source-builds may be impacted by a CWE-1395 eg. vulnerable setuptools dependency. Multicast prior to v2.0.9a3 on systems with minimal dependancies installed may use setuptools =80.4 Pre-release version v2.0.9a3 and later are recommended for improved stability over v2.0.9a0 Workarounds...

Malicious code in reacts-gh (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f438d6df955eb639b0090cb670175f993ce6f6e5ce1f8d1926d236447864460 Any computer that has this package installed or running should be considered...

MAL-2025-4577 Malicious code in reacts-gh (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f438d6df955eb639b0090cb670175f993ce6f6e5ce1f8d1926d236447864460 Any computer that has this package installed or running should be considered...