GHSA-fqfh-778m-2v32
GitHub CLI can execute a git binary from the current directory
GHSA-fqfh-778m-2v32 is a vulnerability with no CVSS score yet in github.com/cli/cli, published February 11, 2022. No source lists public exploit code. Fixed in github.com/cli/cli 1.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.1github.com/cli/cli
Description
Impact
GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.
Windows users who run gh inside untrusted directories are affected.
Patches
Users should upgrade to GitHub CLI v1.2.1.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
References
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cli/cliGo | before 1.2.1 | 1.2.1 |
What each source reports
GitHub AdvisoriesNo score
GitHub CLI can execute a git binary from the current directory
Impact
GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.
Windows users who run gh inside untrusted directories are affected.
Patches
Users should upgrade to GitHub CLI v1.2.1.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
References
- Record
GHSA-fqfh-778m-2v32- Updated
- 2026-11-02
OSVNo score
GitHub CLI can execute a git binary from the current directory
Impact
GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.
Windows users who run gh inside untrusted directories are affected.
Patches
Users should upgrade to GitHub CLI v1.2.1.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
References
- Record
GHSA-fqfh-778m-2v32- Updated
- 2026-11-02
OSVGO-2022-0395No score
GitHub CLI can execute a git binary from the current directory in github.com/cli/cli
GitHub CLI can execute a git binary from the current directory in github.com/cli/cli
- Record
GO-2022-0395- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.