{"id":"CVE-2024-53858","aliases":["GHSA-jwcm-9g39-pmcw","GO-2024-3296"],"url":"https://o3.security/vulnerability/CVE-2024-53858","summary":"Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli","details":"### Summary\n\nA security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com.\n\n### Details\n\nThis vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, `gh pr checkout`. These GitHub CLI commands invoke `git` with instructions to retrieve authentication tokens using the [`credential.helper`](https://git-scm.com/docs/gitcredentials) configuration variable for any host encountered.\n\nPrior to `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage:\n\n- `GITHUB_ENTERPRISE_TOKEN`\n- `GH_ENTERPRISE_TOKEN`\n- `GITHUB_TOKEN` _when `CODESPACES` environment variable is set_\n\nThe result being `git` sending authentication tokens when cloning submodules.\n\nIn `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com.\n\n### Impact\n\nSuccessful exploitation could lead to a third-party using leaked authentication tokens to access privileged resources.\n\n### Remediation and mitigation\n\n1. Upgrade `gh` to `2.63.0`\n2. Revoke authentication tokens used with the GitHub CLI: \n    - [Personal access tokens](https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)\n    - [GitHub CLI OAuth app](https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps)\n3. Review your personal [security log](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log) and any relevant [audit logs](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token) for actions associated with your account or enterprise","published":"2024-11-27T21:25:14.071Z","modified":"2026-08-12T03:51:36.449460505Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/cli/cli/v2","fixedVersion":"2.63.0"}],"fix":null,"references":[{"type":"WEB","url":"https://git-scm.com/docs/gitcredentials"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53858.json"},{"type":"ADVISORY","url":"https://github.com/cli/cli/security/advisories/GHSA-jwcm-9g39-pmcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53858"},{"type":"PACKAGE","url":"https://github.com/cli/cli"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.449460505Z"}}