This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-59831 →

DEBIAN-CVE-2026-59831

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can...

Original description

The description as published by the source.

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 gh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org