Executive brief
GitHub CLI can execute a git binary from the current directory
Affected products
- Go github.com/cli/cli
Junglewise Threat Intelligence
GitHub CLI can execute a git binary from the current directory
Severity: info ยท Published 2022-02-11
Technologies: github.com/cli/cli (Go). Vendors: Go.
Related threats
- GitHub CLI incorrect authorization header in attestation and release commands
- GitHub CLI terminal escape sequence injection in gh run view
- GO-2025-3467 - `gh attestation verify` returns incorrect exit code during verification if no attestations are present in github.com/cli/cli
- GO-2024-3310 - Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli
- GO-2024-3296 - Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli