Skip to content
OpenAdvisories

Package · Go

github.com/cli/cli

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-48501

    GitHub CLI tokens leak via `gh attestation` commands

    GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a…

    cli cli gh github.com/cli/cli Debian Go
  • High 8.0
    CVE-2024-52308

    Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

    The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote cod…

    cli cli gh github.com/cli/cli Debian Ubuntu Go