GHSA-fqfh-778m-2v32

    Dashboard / Vulnerabilities / GHSA-fqfh-778m-2v32

    GHSA-fqfh-778m-2v32

    Published: 11 Feb 2022Last Modified: 21 Aug 2024
    Aliases:
    GO-2022-0395

    Summary: GitHub CLI can execute a git binary from the current directory

    Details: ### Impact GitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\git.exe` or `.\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one. Windows users who run `gh` inside untrusted directories are affected. ### Patches Users should upgrade to GitHub CLI v1.2.1. ### Workarounds Other than avoiding untrusted repositories, there is no workaround. ### References https://github.com/golang/go/issues/38736

    References: https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32

    Affected packages

    Package

    Name: github.com/cli/cli

    Purl: pkg:golang/github.com/cli/cli

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.2.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-fqfh-778m-2v32 | CVE-DB