{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/cli/go-gh","cve_ids":["CVE-2024-53859"],"ecosystem":"Go","epss":0.00531,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-55v3-xh23-96gh","id":"tcs_01M5KG64QJ88EJCRYVPXM38FXQ","modified_at":"2026-02-04T03:36:21.110984Z","published_at":"2024-12-12T15:46:49Z","references":["https://osv.dev/vulnerability/GO-2024-3295","https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh","https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps","https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log","https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token","https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens","https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go#L73-L77"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GO-2024-3295","url":"https://osv.dev/vulnerability/GO-2024-3295"},{"source":"nvd","source_id":"CVE-2024-53859","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53859"}],"summary":"Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh"}