{"id":"CVE-2026-59831","aliases":["AZL-92328","DEBIAN-CVE-2026-59831","EUVD-2026-42741","GHSA-8cg3-r6g9-fpg2","UBUNTU-CVE-2026-59831","openSUSE-SU-2026:12163-1","openSUSE-SU-2026:22134-1"],"status":"published","title":"GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00326,"percentile":0.25981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-829"],"published":"2026-07-09T22:11:05Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.62.0-20"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-20"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0+dfsg1-1","2.24.3+dfsg1-1","2.27.0+dfsg1-1","2.30.0-1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.46.0-1","2.46.0-2","2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0+dfsg1-1","2.4.0+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2","2.45.0-1ubuntu0.2+esm1","2.45.0-1ubuntu0.2+esm2","2.45.0-1ubuntu0.3","2.45.0-1ubuntu0.3+esm1","2.45.0-1ubuntu0.3+esm2","2.45.0-1ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4","2.46.0-4ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.102.0-bp160.1.1"}]}],"bundled":8}],"products":[{"vendor":"cli","product":"cli"}],"references":[{"url":"https://github.com/cli/cli/security/advisories/GHSA-8cg3-r6g9-fpg2","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/cli/cli/commit/b300f2ec7ec9dc9addc39b2ad88c54097ded7ca0","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/cli/cli/releases/tag/v2.96.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59831","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59831.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59831","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59831","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://bugzilla.suse.com/1271215","tags":["report"]},{"url":"https://bugzilla.suse.com/1276707","tags":["report"]},{"url":"https://bugzilla.suse.com/1276755","tags":["report"]},{"url":"https://bugzilla.suse.com/1278962","tags":["report"]},{"url":"https://bugzilla.suse.com/1279208","tags":["report"]},{"url":"https://bugzilla.suse.com/1279310","tags":["report"]},{"url":"https://bugzilla.suse.com/1283727","tags":["report"]},{"url":"https://bugzilla.suse.com/1285291","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-59831","title":"GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T22:11:05.418Z","modified":"2026-07-14T01:20:59.985Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-42741","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T22:11:05Z","modified":"2026-07-14T01:20:59Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.696533Z"}],"nvd":[{"id":"CVE-2026-59831","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T23:17:05.483Z","modified":"2026-07-14T02:16:57.493Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-59831","title":"GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T22:11:05.418Z","modified":"2026-10-28T02:30:46.442664953Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59831","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T23:17:05.483Z","modified":"2026-10-01T03:03:28.340911625Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-59831","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T23:17:00Z","modified":"2026-10-17T13:00:29.10907331Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-92328","title":"CVE-2026-59831 affecting package gh for versions less than 2.62.0-20","description":"GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.","status":"published","published":"2026-07-09T23:17:05Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"openSUSE-SU-2026:12163-1","title":"gh-2.102.0-1.1 on GA media","description":"These are all security issues fixed in the gh-2.102.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-17T00:00:00Z","modified":"2026-10-18T11:15:03.242747585Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.102.0, fixing four security issues\n  (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7,\n  GHSA-wjmr-j3rp-mh2g):\n\n  * gh release/run/attestation download and repo read-file --output\n    could write to an unintended file through symbolic links\n  * gh attestation verify compared --source-ref case-insensitively\n  * gh attestation verify matched --signer-workflow only by prefix\n  * gh skill search could inject options into gh skill install\n  * Copy auth codes to the clipboard by default (gh config set\n    clipboard disabled to opt out)\n  * Remove the gh repo garden command and the multi-account migration\n  * Use API SSH URLs for repository clones\n  * Validate repository names during interactive creation\n  * Fix remote branch deletion on owner case mismatch\n  * Propagate the gh path to extensions\n  * Allow ghu_ tokens to attach files\n  * Allow gh repo set-default --unset without an argument\n  * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0,\n    github.com/klauspost/compress to 1.20.1 and Go to 1.27.1\n- Update golang.org/x/net to 0.60.0 to fix\n  excessive CPU consumption on repeated HTTP/2 initial window\n  changes (CVE-2026-78669, bsc#1285291).\n- Require golang(API) \u003e= 1.27 as upstream moved to Go 1.27.\n- Not affected, vendored dependencies are above the fixed version:\n  * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2\n  * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310):\n    grpc is 1.83.2, fixed in 1.83.1\n  * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in\n    1.44.0\n  * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1,\n    contains the fix of 1.18.7\n  * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed\n    version\n  * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last\n    affected version\n","status":"published","published":"2026-10-19T17:22:04Z","modified":"2026-10-20T19:15:03.960243328Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}