Skip to content
OpenAdvisories
Medium USN-8012-1 2 CVEs

gh vulnerabilities

Published Feb 4, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GitHub CLI could behave unexpectedly if users
downloaded a malicious GitHub Actions workflow artifact through gh run
download. An attacker could possibly use this issue to create or overwrite
files in unintended directories. (CVE-2024-54132)

It was discovered that GitHub CLI could behave unexpectedly when cloning
repositories containing git submodules hosted outside of GitHub.com and
ghe.com. An attacker could possibly use this issue to gather authentication
tokens. (CVE-2024-53858)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS gh 2.45.0-1ubuntu0.3+esm2

Vulnerabilities 2

  • Medium 6.5
    CVE-2024-53858

    Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

    The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulner…

    cli cli gh gh Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.3
    CVE-2024-54132

    GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability

    The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run do…

    cli cli gh gh Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2024-53858
  • report
    https://ubuntu.com/security/CVE-2024-54132