Skip to content
OpenAdvisories
High USN-7130-1 1 CVE

gh vulnerability

Published Nov 26, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GitHub CLI incorrectly handled username
validation. An attacker could possibly use this issue to perform
remote code execution if the user connected to a malicious server.
(CVE-2024-52308)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS gh 2.45.0-1ubuntu0.2+esm1

Vulnerabilities 1

  • High 8.0
    CVE-2024-52308

    Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

    The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote cod…

    cli cli gh gh Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2024-52308