Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZxZmgtNzc4bS0ydjMy

GitHub CLI can execute a git binary from the current directory

Impact

GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.

Windows users who run gh inside untrusted directories are affected.

Patches

Users should upgrade to GitHub CLI v1.2.1.

Workarounds

Other than avoiding untrusted repositories, there is no workaround.

References

https://github.com/golang/go/issues/38736

Permalink: https://github.com/advisories/GHSA-fqfh-778m-2v32
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZxZmgtNzc4bS0ydjMy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

Identifiers: GHSA-fqfh-778m-2v32
References:

• https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32
• https://github.com/advisories/GHSA-fqfh-778m-2v32

Repository: https://github.com/cli/cli
Blast Radius: 0.0

Affected Packages