GO-2025-3732 GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh

GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh...

CVE-2025-48938

The CVE-2025-48938 issue affects go-gh (Go modules for GitHub CLI extensions). In affected versions before 2.12.1, an attacker-controlled GitHub Enterprise Server could cause arbitrary commands to run on a user’s machine by substituting HTTP URLs from GitHub with local file paths during browsing....