What is GHSA-25hq-wqc9-cgfc?

GHSA-25hq-wqc9-cgfc is a security advisory published by GitHub Security Advisories with Low severity. Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later...

Which CVE IDs does GHSA-25hq-wqc9-cgfc cover?

GHSA-25hq-wqc9-cgfc covers the following CVE IDs: CVE-2026-107448. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-25hq-wqc9-cgfc?

GHSA-25hq-wqc9-cgfc has a CVSS v3 base score of 3.4, published by GitHub Security Advisories.

GHSA-25hq-wqc9-cgfcLowCVSS 3.4

Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later...

Vendor

GitHub Security Advisories

Published

October 8, 2026

Last Modified

October 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-107448 →

📋 Description

Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. A hypothetical attacker able to control the carousel content delivered to clients can cause arbitrary registered URI-scheme handlers to be invoked on client hosts with no user interaction. For example, one might expect that the carousel content only has https: URIs, not ms-calculator: URIs.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107448
https://github.com/N0tMilk/vulnerability-research/blob/main/Magic/carousel-shellexecute-mtga.md
https://github.com/advisories/GHSA-25hq-wqc9-cgfc