Skip to content
OpenAdvisories

Product · cli

cli

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-72924

    GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

    GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can …

    cli cli gh gh Debian Ubuntu
  • Low 2.1
    CVE-2026-64655

    GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

    GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-…

    cli cli gh gh Debian Ubuntu Go
  • Low 3.3
    CVE-2026-64652

    GitHub CLI: Partial token disclosure in `gh auth status` output

    GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token c…

    cli cli gh gh Debian Ubuntu Go
  • Low 3.5
    CVE-2026-45803

    gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

    `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh…

    cli cli gh github.com/cli/cli Debian Ubuntu Go