InfoSecBulletin Cybersecurity for mankind
A security vulnerability (CVE-2024-52308) in the GitHub Command Line Interface (CLI) could allow remote code execution on users’ devices. With a CVSS score of 8.1, this highlights the need for developers to stay vigilant with software updates and security measures.
The vulnerability arises from how the gh CLI handles SSH connection details with GitHub Codespaces, which uses SSH for secure communication between the local machine and the remote environment.
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
Ransomware Attacks Set Records in February: New Data Shows
Cyber attack at Japanese telecom leader NTT hits 18,000 companies
Cyber heist: Pune losses Rs 6007 crore in cyber scam
According to GitHub’s security advisory, “This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects ssh arguments within the SSH connection details. gh codespace ssh and gh codespace logs commands could execute arbitrary code on the user’s workstation if the remote username contains something like -oProxyCommand=”echo hacked” #.“
If a user connects to a compromised Codespace, the malicious SSH server has the capability to manipulate connection details and inject arbitrary commands. This could result in those commands being executed on the user’s machine, which may lead to severe consequences such as data breaches, system compromises, or even escalated malicious activities.
A successful exploit allows remote code execution (RCE) on a victim’s workstation, which can compromise the system, expose sensitive data, and lead to further attacks.According to GitHub, “Successful exploitation could lead to arbitrary code execution on the user’s workstation, potentially compromising the user’s data and system.”
GitHub has quickly fixed this vulnerability by releasing gh CLI version 2.62.0. Please upgrade to this version immediately.
Furthermore, GitHub advises developers to exercise caution when utilizing custom devcontainer images. “Prefer default or pre-built devcontainers from trusted sources,” the advisory recommends, emphasizing the importance of secure development practices.
Hacker offers “Popular Life Insurance” 36 GB of stolen data for sale
