Summary
Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
Workarounds
If upgrading immediately is not possible:
- Do not run
entire session resumeorentire checkpoint rewindon repositories where untrusted users can push toentire/checkpoints/v1. - Restrict push access to shared repositories until all collaborators have upgraded.
- Inspect the
entire/checkpoints/v1branch for suspicious checkpoint metadata before resuming or rewinding. - Remove or protect shell initialization files and other sensitive user-writable files where feasible.
These mitigations reduce exposure but do not fully address the vulnerability. Upgrading is recommended.
Credits
Thanks Navtej Kathuria for privately reporting this issue to the Entire Security team.
Impact
A path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session directory.
The issue occurs because checkpoint metadata is fetched from the remote entire/checkpoints/v1 branch and the SessionID field was used to construct filesystem paths without validation in the restore path. A malicious SessionID containing absolute paths or path traversal sequences could cause arbitrary files on the victim’s machine to be overwritten.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The patched versions (v0.7.7 or v0.7.8-nightly.*) observe stronger input validation and enforce traversal-resistant primitives to ensure that only descending directories can be accessed by the affected commands.
Frequently Asked Questions
- What is GHSA-2H46-9X5W-4WF7? GHSA-2H46-9X5W-4WF7 is a medium-severity path traversal vulnerability in github.com/entireio/cli (go), affecting versions <= 0.7.6. It is fixed in 0.7.7. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of github.com/entireio/cli are affected by GHSA-2H46-9X5W-4WF7? github.com/entireio/cli (go) versions <= 0.7.6 is affected.
- Is there a fix for GHSA-2H46-9X5W-4WF7? Yes. GHSA-2H46-9X5W-4WF7 is fixed in 0.7.7. Upgrade to this version or later.
- Is GHSA-2H46-9X5W-4WF7 exploitable, and should I be worried? Whether GHSA-2H46-9X5W-4WF7 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-2H46-9X5W-4WF7 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-2H46-9X5W-4WF7? Upgrade
github.com/entireio/clito 0.7.7 or later.