CVE-2024-52308

What it actually does

Command injection in GitHub CLI allows remote code execution when `gh codespace ssh` or `gh codespace logs` connect to a malicious Codespace SSH server.

Why it matters to the business

User workstations could be fully compromised, enabling data theft or further attacks; stable low EPSS and absence from KEV indicate limited observed exploitation but high severity for developers using Codespaces.

How an attack unfolds

An attacker hosts a malicious SSH server mimicking a Codespace endpoint; a victim runs the affected gh commands against it; the server returns crafted responses that inject and execute arbitrary commands on the victim's machine.

How to fix it

Upgrade GitHub CLI to the latest patched release; restrict use of codespace commands to verified trusted endpoints and consider disabling the affected subcommands via policy until updated.

How to confirm the fix worked

Confirm the installed gh version is newer than the vulnerable release; run the commands against a known-good Codespace and verify no unexpected processes or command execution occur.

Typical attack path

1. Attacker deploys malicious Codespace SSH server
2. Victim is induced to run gh codespace ssh or gh codespace logs against the attacker server
3. Malicious responses trigger command injection in the CLI
4. Arbitrary code executes with the privileges of the gh process

How to detect it

Review shell history and process logs for gh codespace invocations connecting to unexpected hosts; monitor for child processes spawned immediately after gh codespace commands.

What your security team should do

• Prioritize patching GitHub CLI across developer workstations
• Add gh binary execution to endpoint monitoring
• Train users to verify Codespace hostnames before connecting
• Review and restrict use of codespace subcommands in high-risk environments