AZL-92328

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92328.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-92328

Upstream

CVE-2026-59831

Published

2026-07-09T23:17:05Z

Modified

2026-08-29T05:27:27Z

Summary

CVE-2026-59831 affecting package gh for versions less than 2.62.0-20

Details

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59831

Affected packages

Azure Linux:3 / gh

Package

Name: gh
Purl: pkg:rpm/azure-linux/gh

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.62.0-20

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92328.json"