CVE-2024-53858 — Sensitive Information Exposure in CLI CLI V2
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 83.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 27
Latest updateFeb 4
Description
The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve au…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:LExploitability: 1.0 | Impact: 5.5
Affected Packages6 packages
🔴Vulnerability Details
5OSV▶
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli↗2024-12-02
OSV▶
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts↗2024-11-27
GHSA▶
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts↗2024-11-27