CVE-2024-53858: GitHub CLI Vulnerability Leading to Token Leakage via Recursive Repository Cloning
Summary
CVE-2024-53858: Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts. Affects github.com/cli/cli/v2 versions < 2.63.0. Fixed in 2.63.0. How to fix ↓
Also tracked for
- github.com/cli/cli · Go
- gh · Debian:12
The same CVE-2024-53858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI is a command-line tool that allows users to interact with GitHub repositories and perform various tasks such as cloning, forking, and checking out pull requests. It simplifies the workflow for developers by providing a seamless interface to manage GitHub resources directly from the terminal. However, a vulnerability has been identified that affects its handling of authentication tokens when cloning repositories with submodules from non-GitHub hosts.
Vulnerability Detail
A security vulnerability in GitHub CLI allows for the potential leakage of authentication tokens when cloning repositories that contain 'git' submodules hosted outside of GitHub.com and ghe.com. This issue arises from the way certain GitHub CLI commands, such as 'gh repo clone', 'gh repo fork', and 'gh pr checkout', interact with the 'git' command. These commands retrieve authentication tokens using the 'credential.helper' configuration variable for any encountered host. Prior to version 2.63.0, the CLI treated non-GitHub hosts as GitHub Enterprise Server hosts, leading to the unintended exposure of tokens sourced from environment variables like GITHUB_ENTERPRISE_TOKEN, GH_ENTERPRISE_TOKEN, and GITHUB_TOKEN. The exploitation of this vulnerability could allow unauthorized access to privileged resources by third parties using the leaked tokens.
How To Fix
Latest published version: v2.103.0 as of 23 Oct 2026
go get github.com/cli/cli/v2@v2.103.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.63.0
This is the first release that contains the fix.
go get github.com/cli/cli/v2@v2.63.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid cloning repositories with submodules from non-GitHub hosts until they can upgrade to version 2.63.0 or later. Additionally, users should revoke any authentication tokens that may have been exposed.
Conclusion
In summary, CVE-2024-53858 presents a significant risk for users of GitHub CLI, particularly when cloning repositories with submodules from non-GitHub hosts. It is crucial for users to upgrade to the latest version and revoke any exposed tokens to mitigate potential security risks.
See every vulnerability recorded for github.com/cli/cli/v2 →
FAQ
CVE-2024-53858 is a security vulnerability in GitHub CLI that can lead to the leakage of authentication tokens when cloning repositories with submodules from non-GitHub hosts.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without needing to sign up.
If you have been affected, you should upgrade your GitHub CLI to version 2.63.0 or later and revoke any potentially exposed authentication tokens.
The exploitation of this vulnerability could allow unauthorized third parties to access sensitive resources using the leaked authentication tokens.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli/v2.
