{
  "cveId": "CVE-2024-52308",
  "url": "https://patchblox.com/security/cve/CVE-2024-52308",
  "summary": "CVE-2024-52308 is fixed in 2 products on 2 platforms, first by GitHub CLI 2.62.0, released November 14, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Connecting to a malicious Codespaces via GH CLI could allow command execution on the user\u0027s computer",
  "description": "The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using \u0060gh codespace ssh\u0060 or \u0060gh codespace logs\u0060 commands. This has been patched in the cli v2.62.0.\n\nDevelopers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing \u0060ssh\u0060 commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for \u0060gh codespace ssh\u0060 or \u0060gh codespace logs\u0060 commands.\n\nThis exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects \u0060ssh\u0060 arguments within the SSH connection details. \u0060gh codespace ssh\u0060 and \u0060gh codespace logs\u0060 commands could execute arbitrary code on the user\u0027s workstation if the remote username contains something like \u0060-oProxyCommand=\u0022echo hacked\u0022 #\u0060.  The \u0060-oProxyCommand\u0060 flag causes \u0060ssh\u0060 to execute the provided command while \u0060#\u0060 shell comment causes any other \u0060ssh\u0060 arguments to be ignored.\n\nIn \u00602.62.0\u0060, the remote username information is being validated before being used.",
  "published": "2024-11-14T15:15:00Z",
  "severity": "High",
  "cvss": 9.6,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
  "cwe": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
  "epss": 0.00906,
  "epssPercentile": 0.60085,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2024-52308",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "GitHub CLI",
      "fixedVersion": "2.62.0",
      "fix": "GitHub CLI 2.62.0",
      "url": "https://patchblox.com/security/fix/windows-app/github.cli-2.62.0",
      "released": "2024-11-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.46.0-2",
      "fix": "DEBIAN-CVE-2024-52308",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-52308",
      "released": "2024-11-14T23:15:05Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.45.0-1ubuntu0.2\u002Besm1",
      "fix": "gh 2.45.0-1ubuntu0.2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-gh-2.45.0-1ubuntu0.2-esm1",
      "released": "2024-11-14T15:15:00Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.46.0-1ubuntu0.2",
      "fix": "gh 2.46.0-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-gh-2.46.0-1ubuntu0.2",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.65.0-bp156.2.17.1",
      "fix": "OPENSUSE-SU-2025:0021-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-0021-1",
      "released": "2025-01-22T10:02:08Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.96.0-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21310-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21310-1",
      "released": "2026-07-10T08:47:45Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}