{"id":"AZL-53996","summary":"CVE-2024-54132 affecting package gh for versions less than 2.62.0-2","details":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","modified":"2026-04-01T05:16:37.746115Z","published":"2024-12-04T16:15:26Z","upstream":["CVE-2024-54132"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54132"}],"affected":[{"package":{"name":"gh","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/gh"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-53996.json"}}],"schema_version":"1.7.5"}