CVE-2025-52483: Registrator.jl Vulnerable to Argument Injection and Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-25 · updated 2026-06-17
Weakness: CWE-77

Description

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.

Affected products

JuliaRegistries Registrator.jl: before 1.9.5 — fixed in 1.9.5

How to fix

Upgrade to a fixed version: JuliaRegistries Registrator.jl 1.9.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-52483 or the next vulnerability affects your stack