CVE-2025-52483

CRITICAL

julialang/registrator < 1.9.5 - Remote Code Execution via Shell Injection

Title source: llm
STIX 2.1

Description

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.

References (2)

Core 2
Core References
Issue Tracking, Patch x_refsource_misc
https://github.com/JuliaRegistries/Registrator.jl/pull/448

Scores

CVSS v3 9.8
EPSS 0.0038
EPSS Percentile 29.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
julialang/registrator < 1.9.5
Published Jun 25, 2025
Tracked Since Feb 18, 2026