{"id":"AZL-54009","summary":"CVE-2024-54132 affecting package gh for versions less than 2.13.0-23","details":"The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.","modified":"2026-04-01T05:16:37.756894Z","published":"2024-12-04T16:15:26Z","upstream":["CVE-2024-54132"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54132"}],"affected":[{"package":{"name":"gh","ecosystem":"Azure Linux:2","purl":"pkg:rpm/azure-linux/gh"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-23"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-54009.json"}}],"schema_version":"1.7.5"}