What is GHSA-fqfh-778m-2v32?

GHSA-fqfh-778m-2v32 is a security advisory published by GitHub Security Advisories with Medium severity. GitHub CLI can execute a git binary from the current directory

Why does GHSA-fqfh-778m-2v32 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-fqfh-778m-2v32?

GHSA-fqfh-778m-2v32 affects 1 product, including: go/github.com/cli/cli:\u003c 1.2.1.

GHSA-fqfh-778m-2v32MediumDisclosed before NVD

GitHub CLI can execute a git binary from the current directory

Vendor

GitHub Security Advisories

Published

February 11, 2022

Last Modified

January 11, 2023

📋 Description

Impact

GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.

Windows users who run gh inside untrusted directories are affected.

Patches

Users should upgrade to GitHub CLI v1.2.1.

Workarounds

Other than avoiding untrusted repositories, there is no workaround.

References

https://github.com/golang/go/issues/38736

🎯 Affected products1

go/github.com/cli/cli:< 1.2.1

🔗 References (2)

https://github.com/cli/cli/security/advisories/GHSA-fqfh-778m-2v32
https://github.com/advisories/GHSA-fqfh-778m-2v32