Ccli

Products

Exploited and recent CVEs

• CVE-2026-72924 Low 2.1 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default 0.3%
• CVE-2026-64655 Low 2.1 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching 0.3%
• CVE-2026-64654 Medium 5.3 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands 0.8%
• CVE-2026-64653 Medium 5.1 GitHub CLI: Unescaped variable components in request URLs could allow path traversal 0.5%
• CVE-2026-64652 Low 3.3 GitHub CLI: Partial token disclosure in `gh auth status` output 0.2%
• CVE-2026-59831 Medium 4.4 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace 0.3%
• CVE-2026-48501 High 7.4 GitHub CLI tokens leak via `gh attestation` commands 0.3%
• CVE-2026-45803 Low 3.5 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection 0.2%
• CVE-2025-48938 Low 2.6 Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server 0.6%
• CVE-2025-25204 Medium 6.3 `gh attestation verify` returns incorrect exit code during verification if no attestations are present 0.4%
• CVE-2024-54132 Medium 6.3 GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability 0.6%
• CVE-2024-53858 Medium 6.5 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli 0.3%
• CVE-2024-53859 Medium 6.5 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace 0.5%
• CVE-2024-52308 High 8.0 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer 0.9%