Security
فارسی
All products

github.com/cli/cli/v2

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
GitHub CLI partially discloses authentication tokens in `gh auth status` outputCVE-2026-64652 · GHSA-CG6R-MPGC-H9MMVersion ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Low Fix reported
GitHub CLI allows attestation verification bypass through unescaped regex metacharactersCVE-2026-64655 · GHSA-MM27-MWQ9-FR5GVersion ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Low Fix reported
GitHub CLI allows path traversal through unescaped request URL componentsCVE-2026-64653 · GHSA-4FJG-2H4Q-FWG3Version ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Low Fix reported
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerabilityCVE-2024-54132 · GHSA-2M9H-R57G-45PJVersion ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Medium Fix reported
`gh attestation verify` returns incorrect exit code during verification if no attestations are presentCVE-2025-25204 · GHSA-FGW4-V983-MGP8Version ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Medium Fix reported
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hostsCVE-2024-53858 · GHSA-JWCM-9G39-PMCWVersion ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Medium Fix reported
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerCVE-2024-52308 · GHSA-P2H2-3VG9-4P87Version ranges need review. github.com/cli/cli/v2github.com/cli/cli Go High Fix reported
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commandsCVE-2026-48501 · GHSA-8XVP-7HJ6-MCJ9Version ranges need review. github.com/cli/cli/v2github.com/cli/cli GoRed Hat High Fix reported
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injectionCVE-2026-45803 · GHSA-CRC3-H8V6-QH57Version ranges need review. github.com/cli/cli/v2github.com/cli/cli Go Low Fix reported