CVE-2026-59831: GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace
GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.
Other sources
GitHub CLI gh codespace jupyter could allow remote code execution when connecting to a malicious Codespace
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.62.0-19 - Upgrade
Upgrade
GitHub CLI (gh)to a version that resolves this vulnerability.Fixed in 2.96.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59831?
The severity of CVE-2026-59831 is medium with a CVSS score of 4.4.
How do I fix CVE-2026-59831?
To fix CVE-2026-59831, update your GitHub CLI to version 2.96.0 or later.
What kind of vulnerability is CVE-2026-59831?
CVE-2026-59831 is a remote code execution vulnerability affecting the GitHub CLI when connecting to a malicious Codespace.
Who is affected by CVE-2026-59831?
Users of GitHub CLI versions 2.10.0 through 2.95.0 may be affected by CVE-2026-59831.
How does CVE-2026-59831 occur?
CVE-2026-59831 occurs when the GitHub CLI opens a JupyterLab URL from a malicious Codespace without proper validation.