What is the CVSS score of CVE-2026-59831?

CVE-2026-59831 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

GitHub CLI CVE-2026-59831

MEDIUM

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-09 GitHub_M

Information Disclosure Suse Cli

4.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.4 MEDIUM

Requires authenticated GitHub user (PR:L) to actively connect to a malicious Codespace (AC:H, UI:R); scope changes as VS Code handles the injected URI on the local machine (S:C).

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 23:34 vuln.today

DescriptionCVE.org

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.

AnalysisAI

Command execution via URI injection in GitHub CLI's gh codespace jupyter subcommand (versions 2.10.0-2.95.0) allows an attacker who controls a Codespace to redirect a connecting developer's VS Code instance into executing arbitrary protocol handler actions. The CLI passes a JupyterLab URL sourced from a process inside the Codespace directly to the OS without validating that the URL is a loopback HTTP or HTTPS address, enabling substitution with a crafted vscode:// or vscode-insiders:// URI. No public exploit has been identified at time of analysis and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, but the scope-change characteristic (S:C) means local VS Code extension execution is a realistic downstream impact.

Technical ContextAI

CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) describes the root cause: the gh codespace jupyter command trusts a URL returned by an arbitrary process running inside the remote Codespace environment - a trust boundary violation. The fix requires validating that the returned URL resolves to a loopback address (127.0.0.1 or ::1) over HTTP or HTTPS before dispatching it to the OS. Without this check, a Codespace-internal process can substitute a vscode:// or vscode-insiders:// protocol handler URI, which the OS hands to VS Code. VS Code's URI handler is capable of invoking extension commands, opening workspaces, or performing file operations on the developer's local machine. The CPE cpe:2.3:a:cli:cli:*:*:*:*:*:*:*:* covers the GitHub CLI (gh) binary across all platforms where it is installed.

RemediationAI

Upgrade GitHub CLI to version 2.96.0 or later, which introduces loopback URL validation before dispatching JupyterLab URLs to the OS. The patch commit is at https://github.com/cli/cli/commit/b300f2ec7ec9dc9addc39b2ad88c54097ded7ca0 and the official release is at https://github.com/cli/cli/releases/tag/v2.96.0. If an immediate upgrade is not feasible, avoid using gh codespace jupyter to connect to any Codespace not created and fully controlled by your own organization. As a compensating control, disabling the vscode:// and vscode-insiders:// URI protocol handlers at the OS level will prevent VS Code from processing injected URIs; note that this trade-off breaks legitimate VS Code deep-link workflows including some extension install flows. Restricting outbound connections from developer workstations to known Codespace endpoints does not mitigate this issue, as the malicious URL is returned over an already-established connection.