Index › shell › github-cli github-cli 1 tool · 1 release line GitHub CLI (gh + git). Every tool here carries the same sandbox boundary. $ boks gh ⧉ Source ↗ Registry ↗ Release lines we maintain · the project decides these findings shown are the whole project at that line Tag Resolves to Lifecycle Updated Findings What the tag promises ▸ latest 2.97.0 stable 2026-08-20 20 tracks the newest supported release stable — floats, carries security updates unstable — tracks pre-releases, may break eol — frozen, upstream is done Tools in this project · pick one to inspect all share one boundary Tool Capabilities Seccomp Findings Image Description ▸ gh netrw default H15M4?1 github-cli GitHub's official command line tool ▸ showing gh from github-cli@latest → 2.97.0 stable Findings H15M4?1 identical on amd64, arm64 — one table describes both CVE Sev CVSS Affects Description CVE-2026-56865 ↗ H 8.4 stdlib A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. GO-2026-6179 ↗ H 8.4 golang.org/x/mod A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. GO-2026-5026 ↗ H 8.2 stdlib The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. CVE-2026-33818 ↗ H 7.5 stdlib Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-46600 ↗ H 7.5 stdlib Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-56853 ↗ H 7.5 stdlib When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. CVE-2026-56859 ↗ H 7.5 stdlib Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56862 ↗ H 7.5 stdlib Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. CVE-2026-56864 ↗ H 7.5 stdlib A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by… GO-2026-5942 ↗ H 7.5 stdlib Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. GO-2026-5972 ↗ H 7.5 stdlib Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. GO-2026-6088 ↗ H 7.5 stdlib Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. GO-2026-6089 ↗ H 7.5 stdlib When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. GO-2026-6090 ↗ H 7.5 stdlib Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. GO-2026-6180 ↗ H 7.5 golang.org/x/mod A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by… CVE-2026-56858 ↗ M 6.1 stdlib Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. GO-2026-6091 ↗ M 6.1 stdlib Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. CVE-2026-56860 ↗ M 5.9 stdlib Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. GO-2026-6218 ↗ M 5.9 stdlib Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. GO-2026-5932 ↗ ? — golang.org/x/crypto The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. These are the findings of github-cli, which ships every tool in this project. boks reports and gates; it never edits an image to clear a finding. Composition default + git runtime none — self-contained composes git Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly. Image image ghcr.io/boks-sh/github-cli:2.97.0 digest sha256:c61c…5322 copy platforms amd64 sha256:c9e9…a8d8 copy arm64 sha256:1202…700a copy size 41 MB unpacked · 1 layer base scratch signed cosign · verified last scan 2026-08-20 Sandbox boundary gh capabilities netrw Filled is granted by default; the rest need --cap at the point of use. seccomp tier per tool default The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier. dotfiles mapped in read-only unless noted ~/.config/gh · writable env passed through 0 of 1 Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask. per-subcommand no overrides Every invocation gets the same boundary. Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere. Provenance sbom amd64 ↗ arm64 ↗ attestation amd64 ↗ arm64 ↗ scan report amd64 ↗ arm64 ↗ grype · 2026-08-20 vex amd64 ↗ arm64 ↗ Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust. 20 findings across this project at latest. Counted once per advisory across every image the project builds.