{
  "cveId": "CVE-2024-53858",
  "url": "https://patchblox.com/security/cve/CVE-2024-53858",
  "summary": "CVE-2024-53858 is fixed in 2 products on 2 platforms, first by GitHub CLI 2.63.0, released November 27, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli",
  "description": "The gh cli is GitHub\u2019s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing \u0060git\u0060 submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several \u0060gh\u0060 commands used to clone a repository with submodules from a non-GitHub host including \u0060gh repo clone\u0060, \u0060gh repo fork\u0060, and \u0060gh pr checkout\u0060. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the \u0060credential.helper\u0060 configuration variable for any host encountered. Prior to version \u00602.63.0\u0060, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. \u0060GITHUB_ENTERPRISE_TOKEN\u0060, 2. \u0060GH_ENTERPRISE_TOKEN\u0060 and 3. \u0060GITHUB_TOKEN\u0060 when the \u0060CODESPACES\u0060 environment variable is set. The result being \u0060git\u0060 sending authentication tokens when cloning submodules. In version \u00602.63.0\u0060, these GitHub CLI commands will limit the hosts for which \u0060gh\u0060 acts as a credential helper to source authentication tokens. Additionally, \u0060GITHUB_TOKEN\u0060 will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise",
  "published": "2024-11-27T14:15:00Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
  "cwe": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
  "epss": 0.00279,
  "epssPercentile": 0.20507,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2024-53858",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "GitHub CLI",
      "fixedVersion": "2.63.0",
      "fix": "GitHub CLI 2.63.0",
      "url": "https://patchblox.com/security/fix/windows-app/github.cli-2.63.0",
      "released": "2024-11-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.46.0-3",
      "fix": "DEBIAN-CVE-2024-53858",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-53858",
      "released": "2024-11-27T22:15:05Z"
    },
    {
      "platform": "linux",
      "product": "gh",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.45.0-1ubuntu0.3\u002Besm2",
      "fix": "gh 2.45.0-1ubuntu0.3\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-gh-2.45.0-1ubuntu0.3-esm2",
      "released": "2024-12-04T08:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}