Cli vulnerabilities
We track 4 vulnerabilities in Cli products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 29, 2026.
Latest Cli vulnerabilities
- 9.1 Critical severity
cli: Incorrect Authorization
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a
- 9.8 Critical severity
go-gh: Trust Boundary Violation
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a
- 7.5 High severity
go-gh: Exposure of Sensitive Information to an Unauthorized Actor
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codes
- 9.6 Critical severity
cli: Improper Neutralization of Special Elements used in a Command
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote code