https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:43:35.430208+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-11233 bdu:2024-11233 2026-10-04T17:43:35.434882+00:00 bdu:2024-11233 https://cve.radiocsirt.org/vuln/euvd-2026-206008 EUVD-2026-206008 2026-10-04T17:43:35.434921+00:00 EUVD-2026-206008 https://cve.radiocsirt.org/vuln/fkie_cve-2024-54132 fkie_cve-2024-54132 2026-10-04T17:43:35.434936+00:00

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.

 https://cve.radiocsirt.org/vuln/ghsa-2m9h-r57g-45pj GHSA-2m9h-r57g-45pj — Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability 2026-10-04T17:43:35.434973+00:00

Affected: Go: github.com/cli/cli/v2, Go: github.com/cli/cli

### Summary

A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`.

### Details

This vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`. The artifact name and `--dir` flag are used to determine the artifact’s download path. When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.

In `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:

``` error downloading ..: would result in path traversal ```

### Impact

Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.

### Remediation and Mitigation

1. Upgrade `gh` to `2.63.1` 2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-54132 msrc_CVE-2024-54132 — GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability 2026-10-04T17:43:35.435016+00:00 msrc_CVE-2024-54132 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14567-1 openSUSE-SU-2024:14567-1 — govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media 2026-10-04T17:43:35.435034+00:00

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-54132 UBUNTU-CVE-2024-54132 2026-10-04T17:43:35.435058+00:00

Affected: Ubuntu:Pro:24.04:LTS: gh

The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.