Insecure Variable Substitution in github.com/go-vela/cli
Summary
GO-2024-2647: CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli. Affects github.com/go-vela/cli versions < 0.23.2. Fixed in 0.23.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The github.com/go-vela/cli package is a Command Line Interface (CLI) tool for Vela, a Continuous Integration and Deployment (CI/CD) platform. It provides a convenient way to interact with Vela and perform various CI/CD tasks. However, a vulnerability has been discovered in the package that allows for insecure variable substitution.
Vulnerability Detail
The vulnerability in github.com/go-vela/cli arises from insecure variable substitution. This means that when using the CLI tool, certain variables are not properly sanitized or validated before being substituted into commands or configurations. An attacker could potentially manipulate these variables to execute arbitrary commands or gain unauthorized access to sensitive information. The vulnerability was introduced in version 0 of the package and has been fixed in version 0.23.2.
How To Fix
Latest published version: v0.28.2 as of 23 Oct 2026
go get github.com/go-vela/cli@v0.28.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.2
This is the first release that contains the fix.
go get github.com/go-vela/cli@v0.23.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to always validate and sanitize user input before using it in commands or configurations to prevent potential security vulnerabilities.
Conclusion
In summary, the github.com/go-vela/cli package is vulnerable to insecure variable substitution, which can lead to potential security vulnerabilities. It is recommended to update to version 0.23.2 or later of the package to fix this vulnerability. If you require further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-vela/cli →
FAQ
github.com/go-vela/cli is a Command Line Interface (CLI) tool for Vela, a Continuous Integration and Deployment (CI/CD) platform. It provides a convenient way to interact with Vela and perform various CI/CD tasks.
Insecure variable substitution refers to the practice of not properly sanitizing or validating variables before substituting them into commands or configurations. This can lead to potential security vulnerabilities, as attackers can manipulate these variables to execute arbitrary commands or gain unauthorized access to sensitive information.
The potential ramifications of this vulnerability include the execution of arbitrary commands by attackers, unauthorized access to sensitive information, and potential compromise of the CI/CD pipeline or associated systems.
To fix this vulnerability, it is recommended to update to version 0.23.2 or later of the github.com/go-vela/cli package. This version includes the necessary fixes to ensure secure variable substitution. Updating can be done by running the command 'go get -u github.com/go-vela/cli@v0.23.2'.
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to always validate and sanitize user input before using it in commands or configurations to prevent potential security vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-vela/cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
