{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"gh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NSKQSBJPVVM0WN4V1GBYZX","modified_at":"2026-10-01T03:03:16.331849519Z","published_at":"2026-05-29T16:16:31.497Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-48501","https://security-tracker.debian.org/tracker/CVE-2026-48501"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-48501","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-48501"}],"summary":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release v"}