CVE-2025-52480
Critical
Description
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
SeverityCritical
CVSS9.8
Exploit probability—
ProductJulialang Registrator
PublishedJun 25, 2025
First seenJun 25, 2025
Weakness typeCWE-88CWE-88
How to fix
Update
- julialang registrator1.9.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| julialang registrator | v < 1.9.5 | 1.9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.