cli cli vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20268

Newest CVEs

• CVE-2026-72924

  GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

  cli · cli

  Low2.1
• CVE-2026-64655

  GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

  cli · cli

  Low2.1
• CVE-2026-64654

  GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

  cli · cli

  Medium5.3
• CVE-2026-64653

  GitHub CLI: Unescaped variable components in request URLs could allow path traversal

  cli · cli

  Medium5.1
• CVE-2026-64652

  GitHub CLI: Partial token disclosure in `gh auth status` output

  cli · cli

  Low3.3
• CVE-2026-59831

  GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace

  cli · cli

  Medium4.4
• CVE-2026-48501

  GitHub CLI tokens leak via `gh attestation` commands

  cli · cli

  High7.4
• CVE-2026-45803

  gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

  cli · cli

  Low3.5
• CVE-2025-25204

  `gh attestation verify` returns incorrect exit code during verification if no attestations are present

  cli · cli

  Medium6.3
• CVE-2024-54132

  GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability

  cli · cli

  Medium6.3