Cli vulnerabilities

Products

• Cli 29
• Go-gh 2

Newest

• @tinacms cli, tinacms +1 more Tina: Code injection via unescaped Git branch name in generated client source CVE-2026-108259 Fix available 8.2 HighOctober 9, 2026
• @quasar app-vite, cli, ssl-certificate +1 more +3 more Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106105 Fix available 8.4 HighOctober 6, 2026
• cli GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default CVE-2026-72924 Fix available 2.1 LowAugust 25, 2026
• cli uniget: Path Traversal in Hook Files - Directory Escape Vulnerability CVE-2026-55062 Fix available 8.4 HighAugust 17, 2026
• cli uniget: EDITOR Command Injection in uniget CLI CVE-2026-55061 Fix available 1.0 LowAugust 17, 2026
• cli GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching CVE-2026-64655 Fix available 2.1 LowAugust 6, 2026
• cli GitHub CLI: Terminal escape sequence injection in multiple `gh` commands CVE-2026-64654 Fix available 5.3 MediumAugust 6, 2026
• cli GitHub CLI: Unescaped variable components in request URLs could allow path traversal CVE-2026-64653 Fix available 5.1 MediumAugust 6, 2026
• cli GitHub CLI: Partial token disclosure in `gh auth status` output CVE-2026-64652 Fix available 3.3 LowAugust 6, 2026
• cli GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace CVE-2026-59831 Fix available 4.4 MediumJuly 9, 2026
• cli Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind CVE-2026-57208 Fix available 6.2 MediumJune 19, 2026
• cli Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets CVE-2026-47671 Fix available 5.4 MediumJune 4, 2026
• cli GitHub CLI tokens leak via `gh attestation` commands CVE-2026-48501 Fix available 7.4 HighMay 29, 2026
• cli gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection CVE-2026-45803 Fix available 3.5 LowMay 15, 2026
• cli uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution CVE-2026-45152 Fix available 7.8 HighMay 13, 2026
• capgo cli Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations CVE-2026-56236 Fix available 6.8 MediumMarch 18, 2026
• @tinacms cli, ssw tinacms\/cli +1 more Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI CVE-2026-29066 Fix available 6.2 MediumMarch 12, 2026
• @tinacms cli, ssw tinacms\/cli +1 more Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS CVE-2026-28793 Fix available 8.4 HighMarch 12, 2026
• @tinacms cli, ssw tinacms\/cli +1 more Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVE-2026-28792 Fix available 9.7 CriticalMarch 12, 2026
• cli, red hat confidential compute attestation, cryostat 4 +32 more +34 more npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability CVE-2026-0775 Fix available 7.0 HighJanuary 23, 2026
• cli go-gh Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server CVE-2025-48938 Fix available 2.6 LowMay 30, 2025
• cli `gh attestation verify` returns incorrect exit code during verification if no attestations are present CVE-2025-25204 Fix available 6.3 MediumFebruary 14, 2025
• cli GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability CVE-2024-54132 Fix available 6.3 MediumDecember 4, 2024
• cli Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli CVE-2024-53858 Fix available 6.5 MediumNovember 27, 2024
• cli go-gh go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace CVE-2024-53859 Fix available 6.5 MediumNovember 27, 2024
• cli Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer CVE-2024-52308 Fix available 8.0 HighNovember 14, 2024
• cli, docker command line interface, fedoraproject fedora +2 more Docker CLI leaks private registry credentials to registry-1.docker.io CVE-2021-41092 Fix available 5.4 MediumOctober 4, 2021
• cli, npmjs npm, fedoraproject fedora +1 more +3 more Sensitive information exposure through logs in npm cli CVE-2020-15095 Fix available 4.4 MediumJuly 7, 2020
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Arbitrary File Overwrite in npm CLI CVE-2019-16777 Fix available 7.7 HighDecember 13, 2019
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Unauthorized File Access in npm CLI before before version 6.13.3 CVE-2019-16776 Fix available 7.7 HighDecember 13, 2019
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Unauthorized File Access in npm CLI before before version 6.13.3 CVE-2019-16775 Fix available 7.7 HighDecember 13, 2019