x/vulndb: potential Go vuln in github.com/cli/cli: CVE-2025-25204

[GoVulnBot]

Advisory CVE-2025-25204 references a vulnerability in the following Go modules:

Module
github.com/cli/cli

Description:
gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, gh attestation verify should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses gh attestation verify's exit codes to gatekeep deployme...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-25204
• FIX: Exit with error if no matching predicate type exists cli/cli#10421
• REPORT: gh attestation verify always returns a 0 exit code cli/cli#10418
• WEB: GHSA-fgw4-v983-mgp8

Cross references:

• github.com/cli/cli appears in 4 other report(s):
  • data/reports/GO-2022-0395.yaml (x/vulndb: potential Go vuln in github.com/cli/cli: GHSA-fqfh-778m-2v32 #395)
  • data/reports/GO-2024-3269.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-p2h2-3vg9-4p87 #3269)
  • data/reports/GO-2024-3296.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-jwcm-9g39-pmcw #3296)
  • data/reports/GO-2024-3310.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-2m9h-r57g-45pj #3310)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cli/cli
      vulnerable_at: 1.14.0
summary: CVE-2025-25204 in github.com/cli/cli
cves:
    - CVE-2025-25204
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-25204
    - fix: https://github.com/cli/cli/pull/10421
    - report: https://github.com/cli/cli/issues/10418
    - web: https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8
source:
    id: CVE-2025-25204
    created: 2025-02-14T18:01:27.934674785Z
review_status: UNREVIEWED