| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cli/cli | ≤ 1.14.0all versions | |
| github.com/cli/cli/v2 | < 2.63.1 | 2.63.1 |
A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.
This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.
In 2.63.1, gh run download will not download artifacts named .. and . and instead exit with the following error message:
error downloading ..: would result in path traversal
Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.
gh to 2.63.1.., to prevent path traversal risks.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free