Impact
GitHub CLI depends on a git.exe executable being found in system %PATH% on Windows. However, if a malicious .\git.exe or .\git.bat is found in the current working directory at the time of running gh, the malicious command will be invoked instead of the system one.
Windows users who run gh inside untrusted directories are affected.
Patches
Users should upgrade to GitHub CLI v1.2.1.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
References
golang/go#38736
dawidgolunski Analyst
Impact
GitHub CLI depends on a
git.exeexecutable being found in system%PATH%on Windows. However, if a malicious.\git.exeor.\git.batis found in the current working directory at the time of runninggh, the malicious command will be invoked instead of the system one.Windows users who run
ghinside untrusted directories are affected.Patches
Users should upgrade to GitHub CLI v1.2.1.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
References
golang/go#38736