PT-2024-9531 · Github+3 · Github Cli+3

Parablack · Published 2024-11-29 · Updated 2026-02-04 · CVE-2024-54132

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green

Name of the Vulnerable Software and Affected Versions GitHub CLI versions prior to 2.63.1

Description A security issue has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This issue stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value.

Recommendations Upgrade gh to 2.63.1 to resolve the issue. As a temporary workaround, consider implementing additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as .., to prevent path traversal risks. Avoid using the --dir flag with untrusted artifact names until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-53996

AZL-54009

BDU:2024-11233

CVE-2024-54132

GHSA-2M9H-R57G-45PJ

GO-2024-3310

OPENSUSE-SU-2024:14567-1

USN-8012-1

Affected Products

Debian

Github Cli

Linuxmint

Ubuntu

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54132.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-54132 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-54132 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53996 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3310 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-54132 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-54009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11233 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8012-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53858 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2m9h-r57g-45pj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54132 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-54132 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-54132 · Vendor Advisory