# CVE-2024-52308: Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

> CVE-2024-52308: Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer. CVSS 8.0 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2024-52308
Last updated: 2026-06-17T08:06:59Z

- Published: 2024-11-14 22:55 UTC · Updated: 2026-06-17 08:06 UTC · Assigner: GitHub\_M
- CVSS: 8.0 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- EPSS: 0.91%, 60th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-77

## Description

The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using \`gh codespace ssh\` or \`gh codespace logs\` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the \[default devcontainer image\]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers\#using-the-default-dev-container-configuration) . GitHub CLI \[retrieves SSH connection details\]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go\#L230-L244 ), such as remote username, which is used in \[executing \`ssh\` commands\]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go\#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go\#L263 ) for \`gh codespace ssh\` or \`gh codespace logs\` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects \`ssh\` arguments within the SSH connection details. \`gh codespace ssh\` and \`gh codespace logs\` commands could execute arbitrary code on the user's workstation if the remote username contains something like \`-oProxyCommand="echo hacked" \#\`.  The \`-oProxyCommand\` flag causes \`ssh\` to execute the provided command while \`\#\` shell comment causes any other \`ssh\` arguments to be ignored. In \`2.62.0\`, the remote username information is being validated before being used.

## Affected vendors and products

- cli: cli
- github: cli

## Tracked companies

- [GitHub](https://rewindex.com/company/github.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-52308)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2024-52308)
- [https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87](https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2024-52308 · Markdown: https://rewindex.com/cve/CVE-2024-52308.md · JSON: https://rewindex.com/api/v1/cves/CVE-2024-52308 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:53.020Z