GitHub CLI 2.97.0 Security Advisory: Terminal Injection, Token Leak, and Regex Bypass CVEs

GitHub CLI 2.97.0 Vulnerability Summary Vulnerability Overview Four security vulnerabilities have been discovered and fixed in GitHub CLI version 2.97.0. Users should update to this version as soon as possible. Affected Areas 1. Terminal Escape Sequence Injection - Affected Commands: , , , , , , - Description: These commands printed content controlled externally without neutralizing terminal escape sequences, allowing escape sequence injection into the user’s terminal. - Reference: GHSA-3m3g-3wcr-px45 2. Unescaped URL Path Metacharacters - Description: Certain request URLs did not escape their variable path components during construction. Values containing URL path metacharacters could cause to process resources differently than intended. - Reference: GHSA-4fpj-2h4q-b9g3 3. Plaintext Output of Authentication Tokens - Affected Command: (without ) - Description: Partial authentication tokens could be printed in plaintext for token types where the format includes an underscore after the , , or prefix. - Reference: GHSA-cp6i-mgpc-h4mm 4. Regular Expression Metacharacters Unescaped in Certificate Matcher - Affected Command: - Description: The and options did not escape regular expression metacharacters. This allowed workflow or repository names to match unexpected signers, potentially bypassing attestation verification. - Reference: GHSA-mm27-mwq8-5f5g Remediation Update Version: Users should update to version as soon as possible. Specific Fixes: - Neutralize terminal escape sequences. - Escape variable path components when constructing request URLs. - Properly handle authentication tokens to prevent plaintext output. - Escape regular expression metacharacters in the certificate matcher. Summary GitHub CLI version 2.97.0 resolves four security vulnerabilities involving terminal escape sequence injection, unescaped URL path metacharacters, plaintext output of authentication tokens, and unescaped regular expression metacharacters in the certificate matcher. Users should update to this version promptly to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub CLI 2.97.0 Security Advisory: Terminal Injection, Token Leak, and Regex Bypass CVEs

More from this source