cli has 7 CVEs on record between 2024 and 2026. 4 were published in the last 90 days. The busiest recent month was August 2026 with 4. The median CVSS is 5.9 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/cli/cli/v2 (4), cli (1), github.com/cli/go-gh/v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- github.com/cli/cli/v2 4
- cli 1
- github.com/cli/go-gh/v2 1
- go-gh 1
Worst active — by depth score
CVE-2025-48938Critical· 9.8go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier54CVE-2024-53859Medium· 6.5`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace36CVE-2026-64654Medium· 5.3GitHub CLI (gh) is GitHub's official command line tool29CVE-2024-54132MediumDownloading malicious GitHub Actions workflow artifact results in path traversal vulnerability28CVE-2026-64652Low· 3.3GitHub CLI (gh) is GitHub's official command line tool18
cli vulnerabilities
CVEs affecting cli, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-64654Medium· 5.3GitHub CLI (gh) is GitHub's official command line tool
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing te…
CVE-2026-64653LowGitHub CLI (gh) is GitHub’s official command line tool
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource…
CVE-2026-64652Low· 3.3GitHub CLI (gh) is GitHub's official command line tool
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part …
CVE-2026-64655LowGitHub CLI (gh) is GitHub’s official command line tool
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex meta…
CVE-2025-48938Critical· 9.8go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing …
CVE-2024-54132MediumDownloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
CVE-2024-53859Medium· 6.5`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace