GitHub Command Line Tool Vulnerability in Artifact Attestation Feature

CVE-2025-25204

What is CVE-2025-25204?

The GitHub Command Line Interface (CLI) tool is susceptible to a vulnerability within its Artifact Attestation verification feature. Specifically, when using the gh attestation verify command, the tool fails to return the appropriate exit status when no attestations are present. Instead of signaling a verification failure with a non-zero exit status, it incorrectly returns a zero exit status. This misbehavior could allow attackers to exploit this flaw, enabling the deployment of malicious artifacts in environments that rely on exit codes for deployment security. Users are strongly encouraged to upgrade to the latest version, v2.67.0, to mitigate this issue and enhance their security posture.

References