| CVE-2026-64655 | THẤP2.1 | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular | 06/08/2026 |
| CVE-2026-64653 | TRUNG BÌNH5.1 | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user inten | 06/08/2026 |
| CVE-2026-64652 | THẤP3.3 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shar | 06/08/2026 |
| CVE-2026-48501 | NGHIÊM TRỌNG9.1 | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authentication layer that automat | 29/05/2026 |
| CVE-2026-45803 | THẤP3.5 | `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way | 15/05/2026 |
| CVE-2025-25204 | TRUNG BÌNH6.3 | `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations | 14/02/2025 |
| CVE-2024-54132 | TRUNG BÌNH6.3 | The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workfl | 04/12/2024 |
| CVE-2024-53858 | TRUNG BÌNH6.5 | The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repo | 27/11/2024 |
| CVE-2024-52308 | NGHIÊM TRỌNG9.6 | The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0.
Developers connect to remote codespaces through an SSH server running within the devcontaine | 14/11/2024 |
| GO-2022-0395 | — | GitHub CLI can execute a git binary from the current directory in github.com/cli/cli | 21/08/2024 |
| GHSA-fqfh-778m-2v32 | TRUNG BÌNH | GitHub CLI can execute a git binary from the current directory | 11/02/2022 |