CVE-2025-25204
`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
- EPSS probability
- 0.41%
- CWE
- CWE-390
- Published
- 2025-02-14
- Last modified
- 2026-03-12
Affected products
- cli cli
Weakness type
Related vulnerabilities
- CVE-2026-76642 — util-linux libmount Privilege Escalation via Failed Mount Helper
- CVE-2026-59845 — Libssh: libssh: denial of service via unchecked proxycommand fork() failure
- CVE-2026-53434 — Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
- CVE-2026-48792 — pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
- CVE-2026-44310 — gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
- CVE-2025-0029 — Improper handling of error condition during host-induced faults can allow a local high-privileged...
- CVE-2025-46367 — Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error...
- CVE-2025-27039 — Detection of Error Condition Without Action in Computer Vision