Trivy is reporting a CVE that looks like it may be a false positive: CVE-2024-52308. #12263
Description
Describe the bug
When running Trivy on a container that pulls the built GitHub CLI from the GitHub releases location, Trivy reports the following:
usr/bin/gh (gobinary)
Total: 1 (HIGH: 1, CRITICAL: 0)
┌───────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├───────────────────────┼────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ github.com/cli/cli/v2 │ CVE-2024-52308 │ HIGH │ fixed │ v2.0.0-20251113120743-680a8c4c4fe2 │ 2.62.0 │ The GitHub CLI version 2.6.1 and earlier are vulnerable to │
│ │ │ │ │ │ │ remote code... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-52308 │
└───────────────────────┴────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
Affected version
# gh --version
gh version 2.83.1 (2025-11-13)
https://github.com/cli/cli/releases/tag/v2.83.1
Steps to reproduce the behavior
Use this sample Dockerfile:
# https://github.com/cli/cli/releases
ARG GH_VERSION=2.83.1
FROM alpine:3.23.0
RUN apk add --no-cache --update \
curl \
unzip
ARG GH_VERSION
RUN curl -fsSLO https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz && \
tar -zxf gh_${GH_VERSION}_linux_amd64.tar.gz && \
chmod +x gh_${GH_VERSION}_linux_amd64/bin/gh && \
cp gh_${GH_VERSION}_linux_amd64/bin/gh /usr/bin
Run a build: docker build -t gh-cli:test -f Dockerfile.test .
Run Trivy: TRIVY_IGNORE_UNFIXED=true TRIVY_SEVERITY=CRITICAL,HIGH trivy image gh-cli:test
Expected vs actual behavior
I do not expect CVE-2024-52308 to be identified.
Logs
Note that it looks like the build of the binary has changed, and this is what results in the issue. Running strings on the binary is returning the version number in v2.83.0+ and not in previous versions:
/tmp # GH_VERSION=2.62.0 && curl -fsSLO https://github.com/cli/cli/releases/download/v${GH_VERSION}
/gh_${GH_VERSION}_linux_amd64.tar.gz && tar -zxf gh_${GH_VERSION}_linux_amd64.tar.gz
/tmp # GH_VERSION=2.83.1 && curl -fsSLO https://github.com/cli/cli/releases/download/v${GH_VERSION}
/gh_${GH_VERSION}_linux_amd64.tar.gz && tar -zxf gh_${GH_VERSION}_linux_amd64.tar.gz
/tmp # GH_VERSION=2.82.1 && curl -fsSLO https://github.com/cli/cli/releases/download/v${GH_VERSION}
/gh_${GH_VERSION}_linux_amd64.tar.gz && tar -zxf gh_${GH_VERSION}_linux_amd64.tar.gz
/tmp # GH_VERSION=2.83.0 && curl -fsSLO https://github.com/cli/cli/releases/download/v${GH_VERSION}
/gh_${GH_VERSION}_linux_amd64.tar.gz && tar -zxf gh_${GH_VERSION}_linux_amd64.tar.gz
/tmp # for i in gh_2.*/bin/gh ; do echo $i: ; strings $i | grep "^mod[[:space:]]*github.com/cli/cli
/v2" ; done
gh_2.62.0_linux_amd64/bin/gh:
mod github.com/cli/cli/v2 (devel)
mod github.com/cli/cli/v2 (devel)
gh_2.82.1_linux_amd64/bin/gh:
mod github.com/cli/cli/v2 (devel)
mod github.com/cli/cli/v2 (devel)
gh_2.83.0_linux_amd64/bin/gh:
mod github.com/cli/cli/v2 v2.0.0-20251104174640-152d328db80d
mod github.com/cli/cli/v2 v2.0.0-20251104174640-152d328db80d
gh_2.83.1_linux_amd64/bin/gh:
mod github.com/cli/cli/v2 v2.0.0-20251113120743-680a8c4c4fe2
mod github.com/cli/cli/v2 v2.0.0-20251113120743-680a8c4c4fe2