Skip to content
OpenAdvisories
Medium USN-7362-1 1 CVE

golang-github-cli-go-gh-v2 vulnerability

Published Mar 20, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that go-gh incorrectly handled authentication
tokens. An attacker could possibly use this issue to leak
authentication tokens to the wrong host. (CVE-2024-53859)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS golang-github-cli-go-gh-v2 2.6.0-1ubuntu0.24.04.1~esm1

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-53859

    go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace

    go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a code…

    cli go-gh wolfictl gh Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2024-53859