CVE-2025-52480

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52480

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

R

egistrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.

References
Link Resource
https://github.com/JuliaRegistries/Registrator.jl/pull/449 Issue Tracking Patch
https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-w8jv-rg3h-fc68 Vendor Advisory Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:julialang:registrator:*:*:*:*:*:julia:*:*
History

19 Sep 2025, 16:02

Type Values Removed Values Added
References () https://github.com/JuliaRegistries/Registrator.jl/pull/449 - () https://github.com/JuliaRegistries/Registrator.jl/pull/449 - Issue Tracking, Patch
References () https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-w8jv-rg3h-fc68 - () https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-w8jv-rg3h-fc68 - Vendor Advisory, Issue Tracking, Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Julialang
Julialang registrator
CPE cpe:2.3:a:julialang:registrator:*:*:*:*:*:julia:*:*

26 Jun 2025, 18:57

Type Values Removed Values Added
Summary
  • (es) Registrator es una aplicación de GitHub que automatiza la creación de solicitudes de extracción de registro para paquetes de Julia en el registro general. Antes de la versión 1.9.5, si la URL del clon devuelta por GitHub era maliciosa (o podía inyectarse mediante vulnerabilidades de origen), era posible inyectar argumentos en la función `gettreesha()`. Esto podría provocar una posible ejecución remota de código. Los usuarios deben actualizar inmediatamente a la versión 1.9.5 para recibir un parche. Todas las versiones anteriores son vulnerables. No se conocen soluciones alternativas.

25 Jun 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-25 17:15

Updated : 2025-09-19 16:02

NVD link : CVE-2025-52480

Mitre link : CVE-2025-52480

CVE.ORG link : CVE-2025-52480

JSON object : View

Products Affected

julialang

CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')