Skip to content
Threat Feed
Subscribe

Product

Cli

2 briefs RSS
high advisory

GitHub CLI Incorrectly Includes Authorization Header in API Requests

GitHub CLI versions 2.92.0 and earlier incorrectly include authorization headers in API requests to TUF repository mirrors and external hosts when using the `gh attestation`, `gh release verify`, and `gh release verify-asset` commands, potentially exposing sensitive tokens.

cli/cli/v2 +1 github cli token leakage api
2r 1t 3i
high advisory

Uniget Command Injection Vulnerability via Malicious Metadata

Uniget is vulnerable to command injection because the `check` field is loaded directly from untrusted JSON metadata without validation, allowing an attacker to execute arbitrary shell commands on the victim's system when performing common uniget operations.

cli command-injection vulnerability linux
2r 1t