CVE-2024-54132mediumCWE-22

CVE-2024-54132: falha de média gravidade em cli

GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability

Publicada em

Seguir esta CVE+ Monitorar cli+ Monitorar gh

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.6%
The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green
Produtos afetados
cli · cli
CVEs relacionadas — cli

No mesmo produto, das mais perigosas para as menos.

CVE-2024-52308HIGHConnecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerEPSS 0.9%CVE-2026-64654MEDIUMGitHub CLI: Terminal escape sequence injection in multiple `gh` commandsEPSS 0.8%CVE-2026-64653MEDIUMGitHub CLI: Unescaped variable components in request URLs could allow path traversalEPSS 0.5%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2026-64655LOWGitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN MatchingEPSS 0.3%CVE-2026-59831MEDIUMGitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious CodespaceEPSS 0.3%