CVE-2025-48938 is a critical flaw (CVSS 9.8) in go-gh, the Go library for writing GitHub CLI extensions, in versions before 2.12.1. A hostile GitHub Enterprise Server could make the browser helper open a local file path instead of a web address. Upgrade to go-gh 2.12.1.
What's affected
The GitHub advisory lists the Go module github.com/cli/go-gh/v2, versions up to and including 2.12.0, with 2.12.1 as the patched version. The CVE record says prior to 2.12.1.
The advisory title and text also cover the GitHub CLI and its extensions, because they use this library. The risk applies to users who connect to a GitHub Enterprise Server host that an attacker controls or has compromised. The advisory says the attacker would modify API responses so that a URL the CLI is asked to open becomes a local executable path.
The advisory rates the issue Low, while the CVE record carries a 9.8 Critical score. The difference reflects the precondition: you have to be talking to a malicious or compromised server. Read the score together with that condition.
How to check if you're exposed
Check which version of go-gh your code and tools use. In a Go project:
go list -m github.com/cli/go-gh/v2
If the module appears in your dependency tree, the command prints the version. To see why it is there:
go mod why -m github.com/cli/go-gh/v2
For a compiled GitHub CLI extension you installed, the library version is built into the binary. Check the extension's release notes for the go-gh version, or update the extension and the GitHub CLI itself, and read their advisories for the fixed release. I could not confirm the GitHub CLI release that picked up the fix from the pages I fetched, so check the CLI's release notes.
Also ask whether anyone on your team points the CLI at a GitHub Enterprise Server host. If nobody does, the exposure is much smaller.
What to do now
- Update go-gh to 2.12.1 or later in any project that imports it, then rebuild and release.
- Update the GitHub CLI and any extensions you rely on to releases that include the fixed library.
- Only use the CLI against Enterprise Server hosts you trust, and treat an unexpected host change as suspicious.
- If you maintain an extension, test your own use of browser opening functions with non web addresses.
Why it matters
The record names the weakness as CWE-501, trust boundary violation. The library took a value supplied by a server, which should be a web address, and handed it to the operating system's open mechanism without checking what it was. A path to a program is a valid input for that mechanism, so the call ran something instead of opening a page.
In version 2.12.1 the browser function allows http, https, vscode and vscode-insiders addresses, and refuses file addresses, paths that match files or directories on disk, and names that match executables on the user's path. That is the right shape of fix: check what you are about to open before you open it.
This is not on the CISA Known Exploited Vulnerabilities list. A dependency scan will flag the library version inside Go projects, and reachability analysis helps you decide whether your code ever calls the browser function.
Quick check
Who is at risk from this CVE?
Users of the GitHub CLI, or of extensions built on go-gh, who connect to a GitHub Enterprise Server host that an attacker controls.
What does version 2.12.1 change?
The browser function now allows web and editor addresses and refuses local files, directories and executables on the path.
Sources
Last reviewed: 18 October 2026.
