{
  "cveId": "CVE-2025-25204",
  "url": "https://patchblox.com/security/cve/CVE-2025-25204",
  "summary": "CVE-2025-25204 is fixed in GitHub CLI on 1 platform by GitHub CLI 2.67.0 (version 2.67.0), released February 11, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "\u0060gh attestation verify\u0060 returns incorrect exit code during verification if no attestations are present",
  "description": "\u0060gh\u0060 is GitHub\u2019s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub\u0027s Artifact Attestation cli tool \u0060gh attestation verify\u0060 causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, \u0060gh attestation verify\u0060 should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses \u0060gh attestation verify\u0060\u0027s exit codes to gatekeep deployments. Users are advised to update \u0060gh\u0060 to patched version \u0060v2.67.0\u0060 as soon as possible.",
  "published": "2025-02-14T17:15:19Z",
  "severity": "",
  "cvss": 6.3,
  "cwe": "CWE-390: Detection of Error Condition Without Action",
  "epss": 0.00406,
  "epssPercentile": 0.35176,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2025-25204",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "GitHub CLI",
      "fixedVersion": "2.67.0",
      "fix": "GitHub CLI 2.67.0",
      "url": "https://patchblox.com/security/fix/windows-app/github.cli-2.67.0",
      "released": "2025-02-11T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}