CL
Vendor
cli
14
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-72924 | CL cli cli | 2.1 | Aug 25 | GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default |
| CVE-2026-64655 | CL cli cli | 2.1 | Aug 6 | GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching |
| CVE-2026-64654 | CL cli cli | 5.3 | Aug 6 | GitHub CLI: Terminal escape sequence injection in multiple `gh` commands |
| CVE-2026-64653 | CL cli cli | 5.1 | Aug 6 | GitHub CLI: Unescaped variable components in request URLs could allow path traversal |
| CVE-2026-64652 | CL cli cli | 3.3 | Aug 6 | GitHub CLI: Partial token disclosure in `gh auth status` output |
| CVE-2026-59831 | CL cli cli | 4.4 | Jul 9 | GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace |
| CVE-2026-48501 | CL cli cli | 9.1 | May 29 | GitHub CLI tokens leak via `gh attestation` commands |
| CVE-2026-45803 | CL cli cli | 3.5 | May 15 | gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection |
| CVE-2025-48938 | GO go-gh cli | 9.8 | May 30 | Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server |
| CVE-2025-25204 | CL cli cli | 6.3 | Feb 14 | `gh attestation verify` returns incorrect exit code during verification if no attestations are present |
| CVE-2024-54132 | CL cli cli | 6.3 | Dec 4 | GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability |
| CVE-2024-53858 | CL cli cli | 6.5 | Nov 27 | Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli |
| CVE-2024-53859 | GO go-gh cli | 7.5 | Nov 27 | go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace |
| CVE-2024-52308 | CL cli cli | 9.6 | Nov 14 | Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer |