CVE-2025-54956 Information disclosure in gh
The R gh library leaks Authorization headers in HTTP responses, allowing attackers to potentially access sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54956?
CVE-2025-54956 is a low-severity vulnerability in r-lib gh, published on 3 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.
Weakness: CWE-669
Which versions are affected by CVE-2025-54956?
1 open source package ship an affected version, including gh.
| Package | Affected | Fixed in |
|---|---|---|
gh CRAN | From 1.1.0 | 1.5.0 |
How do I fix CVE-2025-54956?
Upgrade gh to 1.5.0 or later.
Is CVE-2025-54956 being exploited?
There is no known exploitation of CVE-2025-54956 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-54956, DLA-4378-1, GHSA-gfw5-r5r2-fv73, RSEC-2025-0, UBUNTU-CVE-2025-54956.