{"id":"CVE-2024-54132","aliases":["AZL-53996","AZL-54009","DEBIAN-CVE-2024-54132","EUVD-2024-3409","GHSA-2m9h-r57g-45pj","GO-2024-3310","UBUNTU-CVE-2024-54132","USN-8012-1","openSUSE-SU-2024:14567-1"],"status":"published","title":"GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00629,"percentile":0.50631,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-12-04T15:29:07Z","modified":"2026-11-02T12:02:57Z","fixes":[{"ecosystem":"Go","package":"github.com/cli/cli/v2","fixed_in":["2.63.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.62.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"gh","fixed_in":["2.13.0-23"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gh","fixed_in":["2.46.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","fixed_in":["2.45.0-1ubuntu0.3+esm2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-23"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0+dfsg1-1","2.24.3+dfsg1-1","2.27.0+dfsg1-1","2.30.0-1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.46.0-1","2.46.0-2","2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.0-3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.63.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.14.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.63.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.0-1ubuntu0.3+esm2"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2","2.45.0-1ubuntu0.2+esm1","2.45.0-1ubuntu0.2+esm2","2.45.0-1ubuntu0.3","2.45.0-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.0-1ubuntu0.3+esm2"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2","2.45.0-1ubuntu0.2+esm1","2.45.0-1ubuntu0.2+esm2","2.45.0-1ubuntu0.3","2.45.0-1ubuntu0.3+esm1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241209T183251-1.1"}]}],"bundled":21}],"products":[{"vendor":"cli","product":"cli"}],"references":[{"url":"https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54132","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2m9h-r57g-45pj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54132.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-54132","tags":["advisory"]},{"url":"https://github.com/cli/cli","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-54132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54132","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8012-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53858","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8676","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-54132","title":"GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T15:29:07.426Z","modified":"2024-12-04T21:40:02.517Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:59.177173Z"}],"euvd":[{"id":"EUVD-2024-3409","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T15:29:07Z","modified":"2024-12-04T21:40:02Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium"}],"updated_at":"2026-11-03T00:04:40.496649Z"}],"ghsa":[{"id":"GHSA-2m9h-r57g-45pj","title":"Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability","description":"### Summary\n\nA security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`. \n\n### Details\n\nThis vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`.  The artifact name and `--dir` flag are used to determine the artifact’s download path.  When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.\n\nIn `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:\n\n```\nerror downloading ..: would result in path traversal\n```\n\n### Impact\n\nSuccessful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.63.1`\n2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.","status":"published","published":"2024-12-04T15:32:45Z","modified":"2024-12-04T22:17:32Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-54132","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T16:15:26.73Z","modified":"2026-06-17T08:09:49.843Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"CVE-2024-54132","title":"GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T15:29:07.426Z","modified":"2026-10-28T02:31:10.242883583Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-54132","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T16:15:26.73Z","modified":"2026-11-02T12:02:57.315153044Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","level":"medium"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"GHSA-2m9h-r57g-45pj","title":"Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability","description":"### Summary\n\nA security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`. \n\n### Details\n\nThis vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`.  The artifact name and `--dir` flag are used to determine the artifact’s download path.  When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.\n\nIn `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:\n\n```\nerror downloading ..: would result in path traversal\n```\n\n### Impact\n\nSuccessful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.63.1`\n2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.","status":"published","published":"2024-12-04T15:32:45Z","modified":"2026-09-10T03:50:56.033873628Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2024-54132","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T16:15:00Z","modified":"2026-02-05T20:58:43.571026Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green","level":"medium"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"AZL-53996","title":"CVE-2024-54132 affecting package gh for versions less than 2.62.0-2","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T16:15:26Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54009","title":"CVE-2024-54132 affecting package gh for versions less than 2.13.0-23","description":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","status":"published","published":"2024-12-04T16:15:26Z","modified":"2026-04-21T04:35:26.796923Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"GO-2024-3310","title":"Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli","description":"Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli","status":"published","published":"2024-12-04T16:25:24Z","modified":"2026-02-04T02:55:32.842111Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2024:14567-1","title":"govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-02-04T02:48:53.761072Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-8012-1","title":"gh vulnerabilities","description":"It was discovered that GitHub CLI could behave unexpectedly if users\ndownloaded a malicious GitHub Actions workflow artifact through gh run\ndownload. An attacker could possibly use this issue to create or overwrite\nfiles in unintended directories. (CVE-2024-54132)\n\nIt was discovered that GitHub CLI could behave unexpectedly when cloning\nrepositories containing git submodules hosted outside of GitHub.com and\nghe.com. An attacker could possibly use this issue to gather authentication\ntokens. (CVE-2024-53858)","status":"published","published":"2026-02-04T13:26:02Z","modified":"2026-04-27T18:36:16.720157Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}