gh-legitify

gh-legitify GitHub CLI extension for Strengthen the security posture of your source-code management! Detect and remediate misconfigurations, security and compliance issues across all your GitHub and GitLab assets with ease 🔥 by Legit Security. Install gh extension install legit-labs/gh-legitify...

write-ups

write-ups RCE in Github Desktop v2.9.4 RCE via gh run download GitHub CLI Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion — CVE-2026-55607...

CVE-2020-27955-LFS-main

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

EUVD-2026-54222

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters...

GHSA-MM27-MWQ9-FR5G GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

Summary A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacter...

EUVD-2026-54213

GitHub CLI allows path traversal through unescaped request URL components...

GHSA-4FJG-2H4Q-FWG3 GitHub CLI allows path traversal through unescaped request URL components

Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to addre...

EUVD-2026-54212

GitHub CLI partially discloses authentication tokens in gh auth status output...

GHSA-CG6R-MPGC-H9MM GitHub CLI partially discloses authentication tokens in `gh auth status` output

Summary A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran gh auth status without the --show-toke...

CVE-2026-56855 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, rancher-fleet, flux-image-automation-controller-fips, amazon-ssm-agent, opentelemetry-collector, scorecard, grafana, zarf, kubernetes, gitlab-runner, chisel-fips, kots, litestream, tfsec, grafana-alloy, chainctl-fips, minio-fips,...

CVE-2026-72924

A flaw was found in GitHub CLI. The gh codespace ports forward command, by default, exposes forwarded services on all local network interfaces. This allows a network-adjacent attacker to access these services through the user's machine while port forwarding is active, even if the original...

SUSE CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

Binding to an Unrestricted IP Address

Overview Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address through the ForwardPorts path in pkg/cmd/codespace/ports.go. An attacker can reach a forwarded Codespaces service from other hosts on the victim’s network by having the user run gh codespace ports...

OPENSUSE-SU-2026:21663-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to v0.87.1 and recompile workflows Fix issue triage action compatibility choredeps: bump golang.org/x/crypto from...

Linux Distros Unpatched Vulnerability : CVE-2026-72924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all...

CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

DEBIAN-CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...