CVE-2026-59831: GitHub CLI Codespace Jupyter Command Execution Vulnerability (CVSS 4.4)

Technical summary

The vulnerability stems from improper URL validation in the `gh codespace jupyter` command. When a user executes this command to access JupyterLab within a Codespace environment, the CLI accepts and processes URLs supplied by processes running inside the Codespace without confirming they are loopback addresses (127.0.0.1 or localhost over HTTP/HTTPS). An attacker can craft malicious vscode:// or vscode-insiders:// protocol handler URLs that, when opened, are interpreted by the local VS Code installation in a way that permits code execution. The issue is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), reflecting the failure to sanitize input from an untrusted environment. The attack requires the user to be authenticated to GitHub and actively initiate the Jupyter connection, limiting immediate blast radius but presenting significant risk in shared development environments or when developers routinely connect to external Codespaces.

Business impact

Development teams relying on GitHub Codespaces for collaborative coding face elevated risk of developer machine compromise through social engineering or compromised Codespace templates. An attacker who controls or gains access to a Codespace repository or template can inject malicious Jupyter URL handlers that execute code on the developer's local machine when they attempt to use the Jupyter integration. This could lead to theft of credentials, source code, environment variables, SSH keys, or other sensitive information stored locally. For organizations using Codespaces as a standard development practice, the cumulative risk increases if multiple developers connect to shared or external Codespaces. The vulnerability also impacts supply-chain security, as compromised or malicious Codespace configurations could propagate across development teams.

Affected systems

GitHub CLI (gh) versions 2.10.0 through 2.95.0 are vulnerable. Users running version 2.96.0 or later are not affected. The vulnerability is specific to the `gh codespace jupyter` command and only manifests when a user attempts to open a Jupyter notebook in a Codespace environment. Users who do not use the Codespaces feature or who do not use the `gh codespace jupyter` command are unaffected. Conversely, developers who regularly work with GitHub Codespaces and use Jupyter notebooks for interactive analysis or development are at higher risk.

Exploitability

Exploitation requires several conditions to align: the user must be authenticated to GitHub, must explicitly run the `gh codespace jupyter` command, and must connect to a Codespace controlled or compromised by an attacker. The attacker must craft a vscode:// or vscode-insiders:// URL and inject it as the JupyterLab endpoint. While these conditions are non-trivial, the risk is material in real-world scenarios involving shared Codespace templates, open-source repositories accepting Codespace configuration, or targeted attacks on specific development teams. The CVSS score of 4.4 (MEDIUM) reflects the requirement for user interaction and authentication but also acknowledges the potential for local code execution. This is not a trivial vulnerability, but it is not immediately exploitable at scale without social engineering or supply-chain compromise.

Remediation

Upgrade GitHub CLI to version 2.96.0 or later. This version includes URL validation to ensure that JupyterLab URLs are loopback addresses over HTTP or HTTPS, blocking the malicious vscode:// protocol handler injection attack. Users should verify their current CLI version using `gh --version` and update via their package manager or by downloading the latest release from the GitHub CLI repository.

Patch guidance

Update GitHub CLI to version 2.96.0 or later. For different installation methods: users on macOS can update via Homebrew (`brew upgrade gh`), Linux users can update via their distribution's package manager (apt, dnf, pacman, etc.), and Windows users can update via Chocolatey (`choco upgrade gh`) or direct download from the GitHub CLI releases page. Verify the update with `gh --version` to confirm you are running 2.96.0 or later. If your organization manages GitHub CLI centrally, coordinate the rollout to development machines to ensure consistent coverage.

Detection guidance

Monitor for usage of `gh codespace jupyter` commands, particularly in environments where developers connect to external or untrusted Codespaces. Review local machine logs for unexpected VS Code process launches or invocations of vscode:// or vscode-insiders:// protocol handlers, especially when correlated with Codespace activity. If available, enable GitHub audit logs to track Codespace access and configuration changes. Security teams should also review Codespace configurations and templates across the organization to identify any malicious URL patterns or Jupyter endpoint overrides.

Why prioritize this

Although assigned a MEDIUM severity (CVSS 4.4), this vulnerability merits prompt prioritization for any organization using GitHub Codespaces as a development standard, particularly those hosting shared or public Codespace templates. The attack chain combines social engineering (connecting to a malicious Codespace) with local code execution (via VS Code protocol handler), creating a pathway to developer machine compromise and credential theft. The lack of KEV status indicates this is not yet actively exploited at scale, providing a window for patching before widespread weaponization. Teams with high Codespace adoption should prioritize upgrading within 2-4 weeks; those with lower Codespace usage can extend timelines but should not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects: Network-based attack vector (user connects over the network to a Codespace), High attack complexity (specific conditions and user interaction required), Low privileges (authentication is required, but the attacker is not the primary authenticated party), Required user interaction (the user must execute the Jupyter command), Changed scope (code executes on the local machine, not in the Codespace), and Low confidentiality and integrity impact (information disclosure and data manipulation are possible but not guaranteed across all systems). The score appropriately weights the requirement for user action and the need for the developer to connect to a malicious Codespace, but it does not minimize the real-world impact of developer machine compromise.

Frequently asked questions