Incorrect Exit Code in Attestation Verification - GitHub CLI Vulnerability
Summary
CVE-2025-25204: gh attestation verify returns incorrect exit code during verification if no attestations are present in github.com/cli/cli. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- github.com/cli/cli/v2 · Go
- gh · Debian:12
The same CVE-2025-25204 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI (Command Line Interface) is a tool that allows users to interact with GitHub directly from the terminal. It provides functionalities such as creating pull requests, managing issues, and verifying code authenticity through attestations. The tool is widely used by developers for its efficiency and integration with GitHub workflows. However, it has a vulnerability related to the attestation verification process, specifically when no attestations are present.
Vulnerability Detail
The vulnerability arises in the gh attestation verify command, which is intended to verify the authenticity of code through attestations. When no attestations are present in the repository, the command incorrectly returns a non-zero exit code, which can mislead users into thinking that the verification failed. This issue can lead to confusion and potentially disrupt automated workflows that rely on accurate exit codes to determine the success or failure of operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no direct workaround for this issue. Users are advised to monitor the output of the gh attestation verify command carefully and consider implementing additional checks in their workflows to handle unexpected exit codes.
Conclusion
In summary, the vulnerability in the GitHub CLI related to incorrect exit codes during attestation verification can lead to confusion and disrupt workflows. Users are encouraged to update to the latest versions of the affected packages to mitigate this issue.
See every vulnerability recorded for github.com/cli/cli →
FAQ
The incorrect exit code can lead to confusion in automated systems that rely on exit codes to determine the success of operations, potentially causing disruptions in workflows.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, a patch is available. Users should update to version 2.67.0 or later for the v2 package or the latest version for the main package.
If an immediate update is not possible, monitor the command outputs closely and implement additional checks in your workflows to handle unexpected exit codes.
More information can be found in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2025-3467.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli.
