This vulnerability allows an attacker to execute arbitrary commands on a user’s machine by leveraging the GitHub CLI when connecting to a malicious Codespace. The mechanism involves the CLI opening a JupyterLab URL supplied from within the Codespace; because no validation is performed on the URL, a crafted vscode:// or vscode‑insiders:// link can be handed off to Visual Studio Code, resulting in command execution.

GitHub CLI versions 2.10.0 through 2.95.0 are affected. The issue is resolved in version 2.96.0 and later.

The CVSS score of 4.4 indicates a medium severity, and the EPSS score indicates a very low probability of exploitation, less than 1%. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this by creating a malicious Codespace that supplies a non‑loopback JupyterLab URL containing a vscode protocol scheme; when a user runs "gh codespace jupyter" the URL is executed, giving the attacker remote command execution capability. This exploitation requires the user to run the GitHub CLI against a Codespace controlled by the attacker, so the attack vector is inferred from the description.