CVE-2026-72924

Description

GitHub CLI (gh) is GitHub-s official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user-s non-loopback local IP addresses by other hosts that can route to the user-s machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user-s local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim-s machine while forwarding is active. This issue is fixed in version 2.98.0.