Is CVE-2025-48938 actively exploited?

No active exploitation of CVE-2025-48938 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-48938 be exploited remotely?

Yes. CVE-2025-48938 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-48938?

CVE-2025-48938 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2025-48938

CRITICAL

CVE-2025-48938

CWE-501Published: May 30, 2025· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.

NVD Source

Risk Analysis

Go-gh versions prior to 2.12.1 are vulnerable to arbitrary command execution when interacting with malicious GitHub Enterprise Servers. This critical flaw allows attackers to execute commands on a user's machine, resulting in a 9.8 CVSS score.

No public exploit is known, and it is not in the KEV. The vulnerability is remotely exploitable with low complexity.

Recommended Action

Upgrade to go-gh version 2.12.1 or later.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-48938 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.