{"id":"GHSA-jwcm-9g39-pmcw","summary":"Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts","details":"### Summary\n\nA security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com.\n\n### Details\n\nThis vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, `gh pr checkout`. These GitHub CLI commands invoke `git` with instructions to retrieve authentication tokens using the [`credential.helper`](https://git-scm.com/docs/gitcredentials) configuration variable for any host encountered.\n\nPrior to `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage:\n\n- `GITHUB_ENTERPRISE_TOKEN`\n- `GH_ENTERPRISE_TOKEN`\n- `GITHUB_TOKEN` _when `CODESPACES` environment variable is set_\n\nThe result being `git` sending authentication tokens when cloning submodules.\n\nIn `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com.\n\n### Impact\n\nSuccessful exploitation could lead to a third-party using leaked authentication tokens to access privileged resources.\n\n### Remediation and mitigation\n\n1. Upgrade `gh` to `2.63.0`\n2. Revoke authentication tokens used with the GitHub CLI: \n    - [Personal access tokens](https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)\n    - [GitHub CLI OAuth app](https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps)\n3. Review your personal [security log](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log) and any relevant [audit logs](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token) for actions associated with your account or enterprise","aliases":["CVE-2024-53858","GO-2024-3296"],"modified":"2026-07-17T21:07:19.753620099Z","published":"2024-11-27T21:43:05Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-11-27T21:43:05Z","nvd_published_at":"2024-11-27T22:15:05Z","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/cli/cli/security/advisories/GHSA-jwcm-9g39-pmcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53858"},{"type":"WEB","url":"https://git-scm.com/docs/gitcredentials"},{"type":"PACKAGE","url":"https://github.com/cli/cli"}],"affected":[{"package":{"name":"github.com/cli/cli/v2","ecosystem":"Go","purl":"pkg:golang/github.com/cli/cli/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.63.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.62.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-jwcm-9g39-pmcw/GHSA-jwcm-9g39-pmcw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"}]}