{"id":"GHSA-fqfh-778m-2v32","aliases":["GO-2022-0395"],"status":"published","title":"GitHub CLI can execute a git binary from the current directory","description":"### Impact\nGitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\\git.exe` or `.\\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.\n\nWindows users who run `gh` inside untrusted directories are affected.\n\n### Patches\nUsers should upgrade to GitHub CLI v1.2.1.\n\n### Workarounds\nOther than avoiding untrusted repositories, there is no workaround.\n\n### References\nhttps://github.com/golang/go/issues/38736","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-02-11T23:41:11Z","modified":"2026-03-03T04:52:10Z","fixes":[{"ecosystem":"Go","package":"github.com/cli/cli","fixed_in":["1.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]}],"references":[{"url":"https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fqfh-778m-2v32"}],"sources":{"ghsa":[{"id":"GHSA-fqfh-778m-2v32","title":"GitHub CLI can execute a git binary from the current directory","description":"### Impact\nGitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\\git.exe` or `.\\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.\n\nWindows users who run `gh` inside untrusted directories are affected.\n\n### Patches\nUsers should upgrade to GitHub CLI v1.2.1.\n\n### Workarounds\nOther than avoiding untrusted repositories, there is no workaround.\n\n### References\nhttps://github.com/golang/go/issues/38736","status":"published","published":"2022-02-11T23:41:11Z","modified":"2023-01-11T05:07:24Z","updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-fqfh-778m-2v32","title":"GitHub CLI can execute a git binary from the current directory","description":"### Impact\nGitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\\git.exe` or `.\\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.\n\nWindows users who run `gh` inside untrusted directories are affected.\n\n### Patches\nUsers should upgrade to GitHub CLI v1.2.1.\n\n### Workarounds\nOther than avoiding untrusted repositories, there is no workaround.\n\n### References\nhttps://github.com/golang/go/issues/38736","status":"published","published":"2022-02-11T23:41:11Z","modified":"2024-08-21T14:57:06.65664Z","updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"GO-2022-0395","title":"GitHub CLI can execute a git binary from the current directory in github.com/cli/cli","description":"GitHub CLI can execute a git binary from the current directory in github.com/cli/cli","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-03-03T04:52:10.462841Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}