CVE-2025-48938: Cli Go-gh RCE Vulnerability

CVE-2025-48938 Overview

A command injection vulnerability has been identified in go-gh, a collection of Go modules designed to simplify the authoring of GitHub CLI extensions. In versions prior to 2.12.1, an attacker controlling a GitHub Enterprise Server could execute arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. The Browser.Browse() function failed to properly validate and sanitize URLs before passing them to the system's browser handler, allowing malicious file paths to be executed instead of opened in a browser.

Critical Impact
An attacker with control over a GitHub Enterprise Server instance can achieve arbitrary command execution on client machines by manipulating URL parameters to reference local executable files.

Affected Products

cli go-gh versions prior to 2.12.1
GitHub CLI extensions utilizing the vulnerable Browser.Browse() function
Applications built on go-gh that process URLs from untrusted GitHub Enterprise Server instances

Discovery Timeline

2025-05-30 - CVE CVE-2025-48938 published to NVD
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2025-48938

Vulnerability Analysis

This vulnerability is classified under CWE-501 (Trust Boundary Violation), where the go-gh library fails to properly distinguish between trusted HTTP URLs and potentially malicious local file paths. The Browser.Browse() function in pkg/browser/browser.go was designed to open URLs in the user's default browser. However, the function did not implement adequate validation to ensure the provided argument was actually an HTTP/HTTPS URL rather than a local file path or command.

When a GitHub Enterprise Server is compromised or attacker-controlled, it can serve malicious responses that substitute legitimate HTTP URLs with local file paths. The vulnerable Browser.Browse() function would then pass these paths directly to the operating system's browser handler, which on many systems will execute local files rather than open them in a browser context.

Root Cause

The root cause lies in insufficient input validation within the Browser.Browse() function. The function accepted any string input and passed it to the system browser handler without verifying that the input was a valid HTTP or HTTPS URL. This trust boundary violation allowed file:// URLs and local file paths to be processed in the same manner as legitimate web URLs, creating an execution path for arbitrary commands when those paths pointed to executable files on the local filesystem.

Attack Vector

The attack requires a network-based approach where the attacker controls or compromises a GitHub Enterprise Server instance that the victim's go-gh-based application connects to. The attack flow involves:

The attacker configures a malicious GitHub Enterprise Server or compromises an existing one
When a victim's application requests URLs from the server, the attacker responds with local file paths instead of HTTP URLs
The vulnerable Browser.Browse() function processes these paths without validation
The operating system's browser handler executes the local file, achieving command execution

The security patch introduces URL validation using Go's net/url package to ensure only legitimate HTTP/HTTPS URLs are processed:

package browser

import (
	"fmt"
	"io"
	"net/url"
	"os"
	"os/exec"

Source: GitHub Commit Update

The fix adds imports for fmt and net/url packages, enabling proper URL parsing and validation before the browser handler processes the input.

Detection Methods for CVE-2025-48938

Indicators of Compromise

Unusual process execution chains originating from browser handler processes
go-gh-based applications attempting to access local executable files through browser APIs
Network traffic to GitHub Enterprise Server instances returning non-HTTP URL schemes in responses
Log entries showing Browser.Browse() calls with file:// URLs or local file paths

Detection Strategies

Monitor for process execution events where browser handlers spawn unexpected child processes
Implement application-level logging to capture all inputs to Browser.Browse() calls
Use endpoint detection rules to identify local file path references in browser handler arguments
Review network traffic for responses from GitHub Enterprise Servers containing suspicious URL patterns

Monitoring Recommendations

Enable verbose logging for go-gh-based applications to capture URL handling events
Configure SIEM rules to alert on file path patterns in browser-related process arguments
Audit connections to GitHub Enterprise Server instances and verify server authenticity
Implement runtime application self-protection (RASP) to monitor URL validation in Go applications

How to Mitigate CVE-2025-48938

Immediate Actions Required

Upgrade go-gh to version 2.12.1 or later immediately
Audit all applications and CLI extensions built on go-gh for vulnerable versions
Review logs for any suspicious URL patterns that may indicate past exploitation attempts
Verify the authenticity and security posture of connected GitHub Enterprise Server instances

Patch Information

The vulnerability has been addressed in go-gh version 2.12.1. The patch enhances Browser.Browse() to properly validate URL schemes and reject local file paths. The fix implements URL parsing using Go's net/url package to allow only legitimate HTTP/HTTPS URLs while blocking file system paths and other potentially dangerous schemes.

Patch details are available in the GitHub Security Advisory and the security commit.

Workarounds

No known workarounds are available other than upgrading to version 2.12.1 or later
As a temporary measure, avoid connecting go-gh-based applications to untrusted GitHub Enterprise Server instances
Consider implementing additional input validation at the application layer before calling Browser.Browse()
Restrict network access to only trusted, verified GitHub Enterprise Server instances

bash

# Upgrade go-gh to the patched version
go get github.com/cli/go-gh/v2@v2.12.1

# Verify the installed version
go list -m github.com/cli/go-gh/v2