GitHub

Records179All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical24CVSS 9.0–10.0

CVSS high80CVSS 7.0–8.9

Exploited now

GitHub records in CISA KEV

No GitHub vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Enterprise Server 126 records HIGH Cmark-gfm 10 records HIGH Github 9 records MEDIUM Cli 3 records MEDIUM 491-project 1 record MEDIUM Actions/artifact 1 record MEDIUM Actions Toolkit 1 record MEDIUM Codeql Action 1 record LOW

Records

3 records in Cli · all components

TI-2026-33538 CVE-2026-45803 · GHSA-crc3-h8v6-qh57

gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

MEDIUM 50

`gh` is GitHub’s official command line tool.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00206 Published 2026-05-15 Fixed in 2.92.0 CWE-150

TI-2024-34983 CVE-2024-52308 · GHSA-p2h2-3vg9-4p87

Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

MEDIUM 45

The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00906 Published 2024-11-14 Fixed in 2.62.0 CWE-77

TI-2026-35862 CVE-2026-48501 · GHSA-8xvp-7hj6-mcj9

GitHub CLI tokens leak via `gh attestation` commands

MEDIUM 41

GitHub CLI (gh) is GitHub’s official command line tool.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00289 Published 2026-05-29 Partial fix · 2.93.0 CWE-863

Open these records in search →

Critical	24
High	80
Medium	72
Low	3
No CVSS	0