{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/cli/go-gh","cve_ids":["CVE-2024-53859"],"ecosystem":"Go","epss":0.00531,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-55v3-xh23-96gh","id":"tcs_01M5KEXRC6CH25FNEXEGBSKHMF","modified_at":"2026-09-10T03:50:20.344866743Z","published_at":"2024-11-27T21:43:03Z","references":["https://osv.dev/vulnerability/GHSA-55v3-xh23-96gh","https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh","https://nvd.nist.gov/vuln/detail/CVE-2024-53859","https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps","https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log","https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token","https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens","https://github.com/cli/go-gh","https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go#L73-L77","https://pkg.go.dev/vuln/GO-2024-3295"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-55v3-xh23-96gh#Go/github.com/cli/go-gh","url":"https://osv.dev/vulnerability/GHSA-55v3-xh23-96gh"}],"summary":"`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace"}