Vulnerability GO-2026-5271
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:43 PM UTC
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli
v0.4.0 - v1.14.0
v0.4.0 - v1.14.0
Summary
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli
Details
GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands in github.com/cli/cli
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 hours ago
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
v2.0.0 - v2.96.0 GHSA-mm27-mwq9-fr5g
v2.0.0 - v2.96.0 GHSA-mm27-mwq9-fr5g
Low Risk
4 hours ago
GitHub CLI allows path traversal through unescaped request URL components
v2.0.0 - v2.96.0 GHSA-4fjg-2h4q-fwg3
v2.0.0 - v2.96.0 GHSA-4fjg-2h4q-fwg3
Low Risk
4 hours ago
GitHub CLI partially discloses authentication tokens in `gh auth status` output
v2.0.0 - v2.96.0 GHSA-cg6r-mpgc-h9mm
v2.0.0 - v2.96.0 GHSA-cg6r-mpgc-h9mm
Unknown
3 months ago
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
v2.0.0 - v2.91.0 GO-2026-5335
v2.0.0 - v2.91.0 GO-2026-5335
Unknown
3 months ago
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli
v2.0.0 - v2.91.0 GO-2026-5335
v2.0.0 - v2.91.0 GO-2026-5335
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:43 PM UTC
Fixed (v2.93.0)
4 months ago
May 27, 2026 at 05:32 PM UTC
Last Modified
3 months ago
June 25, 2026 at 07:45 PM UTC