CRITICAL9.8CVE-2025-48938GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh
from 0
HIGH7.4CVE-2026-48501GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands
from 0
MEDIUM6.5Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh