Directory Traversal Affecting gh package, versions <2.46.0-3
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-GH-18674510
- published12 Aug 2026
- disclosed4 Dec 2024
Introduced: 4 Dec 2024
CVE-2024-54132 (opens in a new tab)How to fix?
Upgrade Echo:latest gh to version 2.46.0-3 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream gh package and not the gh package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.