Critical Vulnerability in GitHub CLI (gh): Incorrect Exit Status in Artifact Attestation Verification
Summary
CVE-2025-25204: gh is GitHub’s official command line tool. Affects gh versions 2.23.0+dfsg1-1 – 2.46.0-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI (gh) is an official command line tool developed by GitHub that allows users to interact with GitHub repositories and perform various tasks directly from the terminal. It provides features for managing issues, pull requests, and other GitHub functionalities. However, a recent vulnerability has been identified in the Artifact Attestation verification process, which could lead to security risks when deploying artifacts.
Vulnerability Detail
The vulnerability arises from a bug in the gh attestation verify command, which, starting from version 2.49.0 and prior to version 2.67.0, incorrectly returns a zero exit status when no attestations are present. This behavior is misleading, as it should return a non-zero exit status to indicate a verification failure. An attacker could exploit this flaw to deploy malicious artifacts in systems that rely on the exit codes from gh attestation verify to control deployments, potentially compromising the integrity of the software supply chain.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should manually check for attestations before relying on the exit status of the gh attestation verify command. This can be done by implementing additional checks in deployment scripts to ensure that artifacts are verified correctly before proceeding with deployment.
Conclusion
The vulnerability identified in GitHub CLI (gh) poses a significant risk due to its incorrect handling of exit statuses during artifact verification. Users are strongly advised to update to the latest version to mitigate potential security threats. Implementing additional verification checks can serve as a temporary measure until the update is applied.
See every vulnerability recorded for gh →
FAQ
The vulnerability could allow attackers to deploy malicious artifacts by exploiting the incorrect exit status returned by the gh attestation verify command.
You can check your version of GitHub CLI by running gh --version in your terminal. If it is between versions 2.49.0 and 2.67.0, it is affected.
If an immediate update is not possible, implement additional verification checks in your deployment scripts to ensure that artifacts are validated before deployment.
More information can be found in the official CVE database or by visiting the GitHub CLI repository for updates and security advisories.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for gh.
