mini-shai-hulud-detector

Mini Shai-Hulud Detector One-command scanner for the Mini Shai-Hulud npm supply-chain attack CVE-2026-45321, CVSS 9.6. Critical: detect before rotating tokens The worm installs a persistence daemon gh-token-monitor that runs rm -rf if it detects credential revocation. Do not rotate your GitHub PA...

gh-safe-repo

gh-safe-repo Create GitHub repositories with safe defaults applied, in one command. gh-safe-repo new Branch protection, immutable tags, locked-down Actions, Dependabot, secret scanning with push protection, and private vulnerability reporting are all configured before you push your first commit...

CVE-2026-117558 ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...

gh-legitify

gh-legitify GitHub CLI extension for Strengthen the security posture of your source-code management! Detect and remediate misconfigurations, security and compliance issues across all your GitHub and GitLab assets with ease 🔥 by Legit Security. Install gh extension install legit-labs/gh-legitify...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:22134-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22134-1 advisory. Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,...

Security update for gh (critical)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22134-1 Rating: critical References: bsc1271215 bsc1276707 bsc1276755 bsc1278962 bsc1279208 bsc1279310 bsc1283727 bsc1285291 Cross-References:...

OPENSUSE-SU-2026:22134-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g: gh release/run/attestation download and repo read-file --output could write to an unintended...

PT-2026-118065

GitHub CLI partially discloses authentication tokens in gh auth status output in github.com/cli/cli...

PT-2026-117127

These are all security issues fixed in the gh-2.102.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:12163-1 gh-2.102.0-1.1 on GA media

These are all security issues fixed in the gh-2.102.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-97032 affecting package gh for versions less than 2.102.0-2

CVE-2026-97032 affecting package gh for versions less than 2.102.0-2. A patched version of the package is available...

CVE-2026-78660 affecting package gh for versions less than 2.102.0-2

CVE-2026-78660 affecting package gh for versions less than 2.102.0-2. A patched version of the package is available...

CVE-2026-78659 affecting package gh for versions less than 2.102.0-2

CVE-2026-78659 affecting package gh for versions less than 2.102.0-2. A patched version of the package is available...

CVE-2026-78669 affecting package gh for versions less than 2.102.0-2

CVE-2026-78669 affecting package gh for versions less than 2.102.0-2. A patched version of the package is available...

GitHub CLI partially discloses authentication tokens in `gh auth status` output

Summary A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran gh auth status without the --show-toke...

GHSA-CG6R-MPGC-H9MM GitHub CLI partially discloses authentication tokens in `gh auth status` output

Summary A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran gh auth status without the --show-toke...

gh-dork

gh-dork Proporcione una lista de dorks y, opcionalmente, una de las siguientes opciones: un usuario -u un archivo con una lista de usuarios -uf una organización -org un archivo con una lista de organizaciones -of un repositorio -r También puede pasar: un directorio de salida para almacenar...

AZL-107415 CVE-2026-97032 affecting package gh 2.101.0-1

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107406 CVE-2026-78669 affecting package gh 2.101.0-1

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107409 CVE-2026-78659 affecting package gh 2.101.0-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...