github.com/CLI/cli/v2-v2.85.0: 2 vulnerabilities (highest severity is: 7.4)

[mend-for-github-com]

Vulnerable Library - github.com/CLI/cli/v2-v2.85.0

GitHub’s official command line tool

Library home page: https://proxy.golang.org/github.com/!c!l!i/cli/v2/@⁠v/v2.85.0.zip

Sample Path to Dependency File: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/cli/cli/v2/@⁠v/v2.85.0.mod

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (github.com/CLI/cli/v2-v2.85.0 version)	Remediation Possible**	Reachability
CVE-2026-48501	High	7.4	Not Defined	0.289%	github.com/CLI/cli/v2-v2.85.0	Direct	github.com/cli/cli/v2 - v2.93.0	✅
CVE-2026-39824	Low	3.3	Not Defined	0.114%	golang.org/x/sys-v0.40.0	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-48501

Vulnerable Library - github.com/CLI/cli/v2-v2.85.0

GitHub’s official command line tool

Library home page: https://proxy.golang.org/github.com/!c!l!i/cli/v2/@⁠v/v2.85.0.zip

Sample Path to Dependency File: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/cli/cli/v2/@⁠v/v2.85.0.mod

Dependency Hierarchy:

• ❌ github.com/CLI/cli/v2-v2.85.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authentication layer that automatically attaches tokens to outgoing requests. This layer lacks accurate host detection and can incorrectly attribute the target host, providing it with a token it should never receive. Specifically, the host normalization logic collapses any *.github.com subdomain to github.com, so a request to tuf-repo.github.com (a GitHub Pages site, not a GitHub API endpoint) is treated as a request to github.com and receives the user's github.com token. For hosts that don't match github.com or a known GHES instance at all, the resolver falls back to GH_ENTERPRISE_TOKEN if set. The gh attestation, gh release verify and gh release verify-asset commands fetch data from several external hosts as part of their normal operation (TUF metadata from tuf-repo.github.com and tuf-repo-cdn.sigstore.dev, artifact bundles from Azure Blob Storage). Because these requests go through the same authenticated HTTP client, the token is sent to all of them. This vulnerability is fixed in 2.93.0.

Publish Date: 2026-05-29

URL: CVE-2026-48501

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.289%

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8xvp-7hj6-mcj9

Release Date: 2026-05-29

Fix Resolution: github.com/cli/cli/v2 - v2.93.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-39824

Vulnerable Library - golang.org/x/sys-v0.40.0

Library home page: https://proxy.golang.org/golang.org/x/sys/@⁠v/v0.40.0.zip

Sample Path to Dependency File: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/sys/@⁠v/v0.40.0.mod

Dependency Hierarchy:

• github.com/CLI/cli/v2-v2.85.0 (Root Library)
  • github.com/Mattn/go-isatty-v0.0.20
    • ❌ golang.org/x/sys-v0.40.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

Publish Date: 2026-05-22

URL: CVE-2026-39824

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.114%

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-22

Fix Resolution: https://github.com/golang/sys.git - v0.44.0,golang.org/x/sys - v0.44.0

---

⛑️Automatic Remediation will be attempted for this issue.