CVE-2025-52480 Registrator.jl Argument Injection Vulnerability
Attackers can achieve remote code execution via argument injection in Registrator.jl if the clone URL is malicious or manipulated.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52480?
CVE-2025-52480 is a high-severity command injection vulnerability in JuliaRegistries Registrator.jl, published on 25 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
Weakness: CWE-88
Which versions are affected by CVE-2025-52480?
It affects 1 product.
Products include Julialang Registrator.
How do I fix CVE-2025-52480?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-52480 being exploited?
There is no known exploitation of CVE-2025-52480 in the wild and no public exploit code.
Other vulnerabilities in JuliaRegistries Registrator.jl
Sources
Also known as GHSA-w8jv-rg3h-fc68, JLSEC-2025-4.