SB2025021484 - Detection of Error Condition Without Action in GitHub CLI

Description

This security bulletin contains information about 1 vulnerability.

1) Detection of Error Condition Without Action (CVE-ID: CVE-2025-25204)

CWE-ID: CWE-390 - Detection of error condition without action

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to incorrectly verify an attestation.

The vulnerability exists due to detection of error condition without action in the gh attestation verify command when processing attestations for a specified predicate type. A remote user can supply an artifact and predicate type combination with no matching attestation to incorrectly verify an attestation.

This issue occurs when an artifact contains an attestation with a different predicate type, causing the command to print a verification failure while still exiting with status code 0.

Remediation

Install update from vendor's website.

References

• https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8
• https://github.com/cli/cli/pull/10421