CVE-2026-59831: command execution — MEDIUM

Q: Is CVE-2026-59831 actively exploited?

No confirmed active exploitation of CVE-2026-59831 has been reported, but organizations should still patch proactively.

Q: What systems are affected by CVE-2026-59831?

This vulnerability affects the following AI/ML architecture patterns: Jupyter/notebook-based ML development environments, cloud developer environments (Codespaces/devcontainers), AI/ML engineering CI/CD and developer tooling supply chain.

Q: What is the CVSS score for CVE-2026-59831?

CVE-2026-59831 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.33%.

CISO Take

GitHub CLI's `gh codespace jupyter` command hands off a JupyterLab connection URL supplied by the remote Codespace to VS Code without verifying it is a loopback address, so a malicious or compromised Codespace can substitute a crafted vscode:// or vscode-insiders:// URI and trigger local command execution on the developer's machine. The blast radius is every developer using gh CLI 2.10.0-2.95.0 to open Jupyter notebooks in Codespaces — a common workflow for AI/ML experimentation and prototyping — but exploitation requires the victim to actively connect to an attacker-controlled Codespace (high attack complexity, user interaction required), there is no EPSS data or known public exploit, and it is not in CISA KEV. This is a developer-workstation supply-chain risk rather than a production AI system flaw: if a data scientist opens a poisoned repo/devcontainer as a Codespace, the attacker can escape the cloud sandbox and land code execution on the local host holding source code, cloud credentials, and CI/CD secrets. Upgrade gh CLI to 2.96.0 or later immediately, and until then avoid running `gh codespace jupyter` against Codespaces or repos from untrusted sources; fleet-wide, audit installed gh CLI versions across ML engineering teams.

Sources: NVD GitHub Advisory

What is the risk?

Medium severity (CVSS 4.4, AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N). The changed scope (S:C) and required user interaction mean the practical risk is bounded — an attacker cannot exploit this remotely without first getting a developer to point their gh CLI at an attacker-controlled Codespace, and the vulnerable step itself requires the victim to be authenticated with low privileges and to actively trigger the jupyter handoff. No public exploit code, no Nuclei template, and not in CISA KEV, so opportunistic mass exploitation is unlikely. However, the impact if triggered is meaningful (local code execution on a developer workstation, confidentiality/integrity compromise), and the attack surface is specifically development environments used for AI/ML notebook work, making this relevant to engineering teams that lean on GitHub Codespaces for ML prototyping.

How does the attack unfold?

Stage malicious Codespace

Attacker publishes a repo/devcontainer whose in-Codespace process returns a crafted vscode:// or vscode-insiders:// URI in place of a legitimate loopback JupyterLab URL.

AML.T0010.001

Victim connects

A developer runs `gh codespace jupyter` against the attacker's Codespace, trusting it as a normal cloud ML dev environment.

AML.T0011.003

Unvalidated URI handoff

gh CLI passes the malicious URI to local VS Code without checking it points to a loopback address, and VS Code's URI handler executes the embedded command.

AML.T0050

Local code execution

The attacker gains code execution on the developer's workstation, escaping the Codespace sandbox and exposing local credentials, source code, and secrets.

AML.T0112

Stage malicious Codespace

Attacker publishes a repo/devcontainer whose in-Codespace process returns a crafted vscode:// or vscode-insiders:// URI in place of a legitimate loopback JupyterLab URL.

AML.T0010.001

Victim connects

A developer runs `gh codespace jupyter` against the attacker's Codespace, trusting it as a normal cloud ML dev environment.

AML.T0011.003

Unvalidated URI handoff

gh CLI passes the malicious URI to local VS Code without checking it points to a loopback address, and VS Code's URI handler executes the embedded command.

AML.T0050

Local code execution

The attacker gains code execution on the developer's workstation, escaping the Codespace sandbox and exposing local credentials, source code, and secrets.

AML.T0112

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Changed

C Low

I Low

A None

What should I do?

1 step

Patch: upgrade GitHub CLI to version 2.96.0 or later fleet-wide (gh --version to audit, gh upgrade or package manager update to remediate). Workaround until patched: do not run gh codespace jupyter against Codespaces created from untrusted or externally-shared repositories/devcontainers; treat any Codespace not created by your own org as untrusted. Detection: audit CI/dev images and developer laptops for gh CLI versions <2.96.0; monitor for unexpected vscode:// / vscode-insiders:// URI handler invocations correlated with gh codespace jupyter usage in EDR/URI-handler logs. Longer term, restrict which repositories can be opened as Codespaces for ML engineering teams via GitHub org policy.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework AML.T0010.001 - AI Software AML.T0011.003 - Malicious Link AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security and resilience

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-59831?

GitHub CLI's `gh codespace jupyter` command hands off a JupyterLab connection URL supplied by the remote Codespace to VS Code without verifying it is a loopback address, so a malicious or compromised Codespace can substitute a crafted vscode:// or vscode-insiders:// URI and trigger local command execution on the developer's machine. The blast radius is every developer using gh CLI 2.10.0-2.95.0 to open Jupyter notebooks in Codespaces — a common workflow for AI/ML experimentation and prototyping — but exploitation requires the victim to actively connect to an attacker-controlled Codespace (high attack complexity, user interaction required), there is no EPSS data or known public exploit, and it is not in CISA KEV. This is a developer-workstation supply-chain risk rather than a production AI system flaw: if a data scientist opens a poisoned repo/devcontainer as a Codespace, the attacker can escape the cloud sandbox and land code execution on the local host holding source code, cloud credentials, and CI/CD secrets. Upgrade gh CLI to 2.96.0 or later immediately, and until then avoid running `gh codespace jupyter` against Codespaces or repos from untrusted sources; fleet-wide, audit installed gh CLI versions across ML engineering teams.

Is CVE-2026-59831 actively exploited?

No confirmed active exploitation of CVE-2026-59831 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59831?

Patch: upgrade GitHub CLI to version 2.96.0 or later fleet-wide (`gh --version` to audit, `gh upgrade` or package manager update to remediate). Workaround until patched: do not run `gh codespace jupyter` against Codespaces created from untrusted or externally-shared repositories/devcontainers; treat any Codespace not created by your own org as untrusted. Detection: audit CI/dev images and developer laptops for gh CLI versions <2.96.0; monitor for unexpected vscode:// / vscode-insiders:// URI handler invocations correlated with `gh codespace jupyter` usage in EDR/URI-handler logs. Longer term, restrict which repositories can be opened as Codespaces for ML engineering teams via GitHub org policy.

What systems are affected by CVE-2026-59831?

This vulnerability affects the following AI/ML architecture patterns: Jupyter/notebook-based ML development environments, cloud developer environments (Codespaces/devcontainers), AI/ML engineering CI/CD and developer tooling supply chain.

What is the CVSS score for CVE-2026-59831?

CVE-2026-59831 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

Jupyter/notebook-based ML development environmentscloud developer environments (Codespaces/devcontainers)AI/ML engineering CI/CD and developer tooling supply chain

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.003 Malicious Link

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted vscode:// or vscode-insiders:// URL to be handed to VS Code. This issue is fixed in version 2.96.0.

Exploitation Scenario

An attacker publishes a public repository disguised as an AI/ML notebook demo or tutorial (e.g., 'quick-start RAG pipeline in a Codespace') with a devcontainer that, once launched as a GitHub Codespace, runs a process designed to respond to `gh codespace jupyter` with a crafted vscode:// URI instead of a legitimate loopback JupyterLab URL. A data scientist evaluating the repo runs `gh codespace jupyter` to open the notebook; gh CLI receives the malicious URI and, without validating it points to a loopback address, hands it directly to the local VS Code installation. VS Code's URI handler executes the embedded command, giving the attacker code execution on the victim's workstation — outside the Codespace sandbox — with access to local credentials, SSH keys, and any AI/ML project source or secrets stored on that machine.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.