cli vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20252
3. 20268

Newest CVEs

• CVE-2026-72924

  GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

  cli · cli

  Low2.1
• CVE-2026-64655

  GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

  cli · cli

  Low2.1
• CVE-2026-64654

  GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

  cli · cli

  Medium5.3
• CVE-2026-64653

  GitHub CLI: Unescaped variable components in request URLs could allow path traversal

  cli · cli

  Medium5.1
• CVE-2026-64652

  GitHub CLI: Partial token disclosure in `gh auth status` output

  cli · cli

  Low3.3
• CVE-2026-59831

  GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

  cli · cli

  Medium4.4
• CVE-2026-48501

  GitHub CLI tokens leak via `gh attestation` commands

  cli · cli

  High7.4
• CVE-2026-45803

  gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

  cli · cli

  Low3.5
• CVE-2025-48938

  Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

  cli · go-gh

  Low2.6
• CVE-2025-25204

  `gh attestation verify` returns incorrect exit code during verification if no attestations are present

  cli · cli

  Medium6.3