GitHub Vulnerabilities and Affected Products
Vulnerabilities associated with cli.
Products
Clear product- Enterprise Server82 vulnerabilities
- GitHub Enterprise Server46 vulnerabilities
- enterprise_server15 vulnerabilities
- cmark-gfm10 vulnerabilities
- Opensearch3 vulnerabilities
- cli2 vulnerabilities
- codeql-action2 vulnerabilities
- copilot-cli2 vulnerabilities
- github-mcp-server2 vulnerabilities
- codeql-cli-binaries1 vulnerability
- github1 vulnerability
- go-gh1 vulnerability
- paste-markdown1 vulnerability
- secure_headers1 vulnerability
- trilogy1 vulnerability
- view_component1 vulnerability
- vscode-codeql1 vulnerability
- Webiness Inventory1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-53858MEDIUM | Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cliThe gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve au… CWE-200Nov 27, 2024 | CVSS6.5v3.1 | EPSS0.279% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-52308HIGH | Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerThe GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... htt… CWE-77Nov 14, 2024 | CVSS8.0v3.1 | EPSS0.861% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |