CVE-2024-54132: GitHub CLI Path Traversal Vulnerability in Artifact Download
Summary
CVE-2024-54132: Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability. Affects github.com/cli/cli/v2 versions < 2.63.1. Fixed in 2.63.1. How to fix ↓
Also tracked for
- github.com/cli/cli · Go
- gh · Debian:12
The same CVE-2024-54132 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI is a command-line tool that allows users to interact with GitHub repositories directly from their terminal. It provides functionalities such as creating issues, managing pull requests, and downloading artifacts from GitHub Actions workflows. This tool is widely used by developers for its efficiency and integration with GitHub's ecosystem. However, a vulnerability has been identified that could lead to unintended file creation or overwriting in the file system when downloading malicious artifacts.
Vulnerability Detail
A security vulnerability in GitHub CLI allows for path traversal when downloading GitHub Actions workflow artifacts. Specifically, if an artifact is named '..', it can be extracted to a directory one level higher than the specified download directory. This could lead to overwriting files or creating files in unintended locations, potentially leading to further exploitation or data loss. The vulnerability arises from the way the CLI interprets the artifact name and the download directory flag.
How To Fix
Latest published version: v2.103.0 as of 23 Oct 2026
go get github.com/cli/cli/v2@v2.103.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.63.1
This is the first release that contains the fix.
go get github.com/cli/cli/v2@v2.63.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid downloading artifacts from untrusted sources or those that may contain suspicious filenames. Additionally, users can manually check the artifact names before downloading to ensure they do not contain potentially dangerous patterns like '..'.
Conclusion
The identified path traversal vulnerability in GitHub CLI poses a significant risk when downloading artifacts from GitHub Actions workflows. Users are strongly encouraged to upgrade to version 2.63.1 or later to mitigate this risk. Additionally, exercising caution when downloading artifacts from untrusted sources is essential to maintaining system security.
See every vulnerability recorded for github.com/cli/cli/v2 →
FAQ
The vulnerability allows for path traversal when downloading artifacts named '..', potentially leading to file overwriting or creation in unintended directories.
Any version prior to 2.63.1 is affected by this vulnerability. You can check your version by running 'gh --version' in your terminal.
If immediate upgrading is not possible, avoid downloading artifacts from untrusted sources and manually verify artifact names before downloading.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just Gopkg.lock. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Exploitation of this vulnerability could lead to unauthorized file access, data loss, or further exploitation of the system by malicious actors.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli/v2.
