GHSA-fqfh-778m-2v32

Source

https://github.com/advisories/GHSA-fqfh-778m-2v32

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-fqfh-778m-2v32/GHSA-fqfh-778m-2v32.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fqfh-778m-2v32

Aliases

GO-2022-0395

Published

2022-02-11T23:41:11Z

Modified

2024-08-21T14:57:06.656640Z

Summary

GitHub CLI can execute a git binary from the current directory

Details

Impact

GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.

Windows users who run gh inside untrusted directories are affected.

Patches

Users should upgrade to GitHub CLI v1.2.1.

Workarounds

Other than avoiding untrusted repositories, there is no workaround.

References

https://github.com/golang/go/issues/38736

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T22:06:12Z"
}

References

https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32

Affected packages

Go / github.com/cli/cli

Package

Name: github.com/cli/cli; View open source insights on deps.dev
Purl: pkg:golang/github.com/cli/cli

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.1