TI-2024-30450 Aliases CVE-2024-45401 GHSA-fv4g-gwpj-74gr

stripe-cli Path Traversal vulnerability

LOW 35CWE-22Published 2024-09-05 · Updated 2024-12-19

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files. The update in version 1.21.3 addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00207 10th percentileScored 2026-11-07

Fix Fixed stripe-cli (stripe): 1.21.3github.com/stripe/stripe-cli (Go): 1.21.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stripe	stripe-cli	1.11.1 to before 1.21.3	1.21.3	Patch available	CNA
—	github.com/stripe/stripe-cli (Go)	1.11.1 to before 1.21.3	1.21.3	Patch available	GHSA-fv4g-gwpj-74gr

stripe-cli Vendorstripe Affected 1.11.1 to before 1.21.3 Fixed in 1.21.3 Patch available CNA
github.com/stripe/stripe-cli (Go) Vendor— Affected 1.11.1 to before 1.21.3 Fixed in 1.21.3 Patch available GHSA-fv4g-gwpj-74gr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stripe:stripe_cli::::::::	1.11.1 to before 1.21.3	Vulnerable	stripe

cpe:2.3:a:stripe:stripe_cli:*:*:*:*:*:*:*:* Versions 1.11.1 to before 1.21.3 Vulnerable ·stripe

Remediation

Fix · CNA stripe-cli (stripe) Fixed in 1.21.3
Fix · GHSA-fv4g-gwpj-74gr github.com/stripe/stripe-cli (Go) Fixed in 1.21.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-45401
2026-10-03 Alias added: GHSA-fv4g-gwpj-74gr

References

Advisory 2

Other 1

https://github.com/stripe/stripe-cli

TI-2022-08567 Code injection in Stripe CLI on windows CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences