CVE-2025-25204 `gh attestation verify` returns incorrect exit code during verification if no attestations are present
The GitHub CLI incorrectly reports success when attestations are missing, allowing attackers to bypass deployment gates and install malicious artifacts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25204?
CVE-2025-25204 is a medium-severity vulnerability in cli, published on 14 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.
Weakness: CWE-390
Which versions are affected by CVE-2025-25204?
4 open source packages ship an affected version, including github.com/cli/cli/v2 and github.com/cli/cli.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cli/cli/v2 Go | From 2.49.0 | 2.67.0 |
github.com/cli/cli/v2 Go | From 2.49.0 | 2.67.0 |
github.com/cli/cli/v2 Go | From 2.49.0 | 2.67.0 |
github.com/cli/cli Go | All versions | None |
How do I fix CVE-2025-25204?
Upgrade github.com/cli/cli/v2 to 2.67.0 or later.
Is CVE-2025-25204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25204 exists.
Sources
Also known as AZL-56885, GHSA-fgw4-v983-mgp8, GO-2025-3467.