Repository navigation
Security: github/gh-aw
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Sandboxed code can steal and silently exfiltrate the gh-aw job tokenGHSA-9jxf-w4wc-5g93 published
Oct 14, 2026 by pelikhanCritical -
GHSL-2026-188, GHSL-2026-189: Flag injection in MCP tool handlers via unseparated positional argumentsGHSA-62c8-mmw9-rq5w published
Oct 14, 2026 by pelikhanCritical -
GHSL-2026-184: Ungated MCP `mcp-inspect` executes attacker-declared stdio command (chained with ungated `add`)GHSA-x5hq-gjxf-pgxm published
Oct 14, 2026 by pelikhanCritical -
GHSL-2026-180: Argv flag injection from MCP client into spawned `gh aw` subcommandsGHSA-f7r8-5pqp-q5p4 published
Oct 14, 2026 by pelikhanCritical -
gh-aw: HTTPS egress allowlist bypass via TLS SNI domain frontingGHSA-x78f-wrrj-4h24 published
Sep 23, 2026 by pelikhanHigh -
Safe-output artifacts may expose CI trigger tokensGHSA-8h78-hpm7-29gg published
Aug 27, 2026 by pelikhanCritical -
gh-aw: the confused-deputy check does not cover pull_request_target, so a labeled fork PR activates the agent on the labeler's permissionsGHSA-r8gh-v7wv-8g7h published
Aug 16, 2026 by pelikhanHigh -
gh-aw: cache-memory restores an attacker-controlled .git/config and executes a git filter driver on the runner hostGHSA-gh77-fhfh-2mc5 published
Aug 16, 2026 by pelikhanHigh -
gh-aw: safe-output validator forwards undeclared agent fields to the appliers (scope escape / mass assignment)GHSA-jxrq-hq57-gwwm published
Aug 8, 2026 by pelikhanCritical -
gh-aw: URL allowlist bypass via userinfo @ in the content sanitizer (exfiltration channel)GHSA-73j6-rcxw-76w7 published
Aug 7, 2026 by pelikhanModerate