GHSA-2m9h-r57g-45pj
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
Quick fix
GHSA-2m9h-r57g-45pj — github.com/cli/cli/v2: upgrade to the fixed version with the command below.
go get github.com/cli/cli/v2@v2.63.1Details
### Summary
A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`.
### Details
This vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`. The artifact name and `--dir` flag are used to determine the artifact’s download path. When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.
In `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:
``` error downloading ..: would result in path traversal ```
### Impact
Successful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.
### Remediation and Mitigation
1. Upgrade `gh` to `2.63.1` 2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/cli/cli (go modules). Pin to a known-safe version or switch to an alternative.