PT-2025-45989
Publicado
2025-10-08
·
Atualizado
2025-10-08
Descrição por
CVSS 3.1
9.8
CríticaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact
If the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), a shell script injection can occur within the
withpasswd() function. This can then lead to a potential RCE.Patches
Users should upgrade immediately to v1.9.5. All prior versions are vulnerable.
Workarounds
None
References
Fixed by: https://github.com/JuliaRegistries/Registrator.jl/pull/448 (which is available in v1.9.5).
Credits
Thanks to splitline from the DEVCORE Research Team for reporting this issue.
Explorabilidade
Correção
Fornecedores
Produtos afetados
Identificadores relacionados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾