CVE-2025-25204
CVE-2025-25204 is a medium-severity vulnerability with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-390.
Key facts
- Severity: Medium (CVSS 3.x base score 6.3)
- EPSS exploit prediction: 0% (30th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-4090
- Weakness: CWE-390
- Published:
- Last modified:
Description
`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.
Frequently asked questions
- What is CVE-2025-25204?
- `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.
- How severe is CVE-2025-25204?
- CVE-2025-25204 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2025-25204 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-25204?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-25204 have an EU (EUVD) identifier?
- Yes. CVE-2025-25204 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4090.
- When was CVE-2025-25204 published?
- CVE-2025-25204 was published on 2025-02-14 and last updated on 2026-06-17.
References
- https://github.com/cli/cli/issues/10418
- https://github.com/cli/cli/pull/10421
- https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8
Other CWE-390 vulnerabilities
- CVE-2026-52989 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec()…
- CVE-2026-53434 — Critical (CVSS 9.1): Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based…
- CVE-2025-46367 — High (CVSS 7.8): Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without…
- CVE-2024-27919 — High (CVSS 7.5): Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol…
- CVE-2025-26465 — Medium (CVSS 6.8): A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be…
- CVE-2025-27039 — Medium (CVSS 6.6): Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.