CVE-2025-54956

EUVD-2025-23481
The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.2 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3.97%
Debian logo
Debian Releases
Debian Product
Codename
r-cran-gh
bookworm
1.4.0-1+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
1.2.0-1+deb11u1
fixed
forky
1.6.1-1
fixed
sid
1.6.1-1
fixed
trixie
1.4.1-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
r-cran-gh
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
ignored
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/r-lib/gh/commit/b575d488c71318449cc6c8c989c617db29275848
https://github.com/r-lib/gh/compare/v1.4.1...v1.5.0
https://github.com/r-lib/gh/issues/222
https://lists.debian.org/debian-lts-announce/2025/11/msg00021.html