Executive brief
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli
Affected products
- Go github.com/cli/cli
- Go github.com/cli/cli/v2
Junglewise Threat Intelligence
CVE-2024-53858: GO-2024-3296 - Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli
CVE-2024-53858 · Severity: low · CVSS 3.1 · Published 2024-12-02
Technologies: github.com/cli/cli (Go), github.com/cli/cli/v2 (Go). Vendors: Go.
Related threats
- GitHub CLI incorrect authorization header in attestation and release commands
- GitHub CLI terminal escape sequence injection in gh run view
- GO-2025-3467 - `gh attestation verify` returns incorrect exit code during verification if no attestations are present in github.com/cli/cli
- GO-2024-3310 - Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli
- GO-2024-3269 - Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli