CVE-2024-54132Medium▾ SunlitDownloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.
This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.
In 2.63.1, gh run download will not download artifacts named .. and . and instead exit with the following error message:
error downloading ..: would result in path traversal
Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.
gh to 2.63.1.., to prevent path traversal risks.github.com/cli/cli/v2 < 2.63.1github.com/cli/cli <= 1.14.0Upgrade to a patched release:
github.com/cli/cli/v2 2.63.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-53859Medium· 6.5`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
CVE-2026-64654Medium· 5.3GitHub CLI (gh) is GitHub's official command line tool
CVE-2025-48938Critical· 9.8go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier