write-ups

write-ups RCE in Github Desktop v2.9.4 RCE via gh run download GitHub CLI Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion — CVE-2026-55607...

gh-legitify

gh-legitify GitHub CLI extension for Strengthen the security posture of your source-code management! Detect and remediate misconfigurations, security and compliance issues across all your GitHub and GitLab assets with ease 🔥 by Legit Security. Install gh extension install legit-labs/gh-legitify...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955-LFS-main

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public...

GO-2026-6767 GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...

GO-2026-6765 GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli

GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...

PT-2026-118066

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli...

PT-2026-118065

GitHub CLI partially discloses authentication tokens in gh auth status output in github.com/cli/cli...

PT-2026-118064

GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli...

EUVD-2026-54222

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters...

GHSA-MM27-MWQ9-FR5G GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

Summary A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacter...

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

Summary A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacter...

GHSA-4FJG-2H4Q-FWG3 GitHub CLI allows path traversal through unescaped request URL components

Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to addre...

EUVD-2026-54213

GitHub CLI allows path traversal through unescaped request URL components...

GitHub CLI allows path traversal through unescaped request URL components

Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to addre...

GHSA-CG6R-MPGC-H9MM GitHub CLI partially discloses authentication tokens in `gh auth status` output

Summary A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran gh auth status without the --show-toke...

GitHub CLI partially discloses authentication tokens in `gh auth status` output

Summary A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran gh auth status without the --show-toke...