GHSA-4fjg-2h4q-fwg3: Path Traversal
Summary
A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to address a different resource than intended.
Details
Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.
In 2.97.0, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.
Impact
An attacker who can control a value that flows into a request path can cause gh to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.
Remediation and Mitigation
1. Upgrade gh to 2.97.0. 2. Be cautious when running gh against untrusted repositories or inputs whose names you do not control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/cli/cli/v2to a version that resolves this vulnerability.Fixed in 2.97.0 - Upgrade
Upgrade
GitHub CLI (gh)to a version that resolves this vulnerability.Fixed in 2.97.0 - Compensating control
Use gh cautiously with untrusted repositories or inputs whose names you do not control.
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs to control a value that is incorporated into an HTTP request path by gh. This can arise when gh is run against untrusted repositories or inputs whose names the attacker controls.
What can the attacker cause gh to do?
Path metacharacters in the attacker-controlled value can change the effective API request path. gh may then read or act on a different resource than the user intended.
What should teams do if they cannot immediately upgrade?
Avoid running gh against untrusted repositories or attacker-controlled inputs whose names may flow into request paths. Treat such inputs cautiously until gh can be upgraded.
How can I remediate this vulnerability?
Upgrade gh to version 2.97.0, which constructs request URLs safely so variable path components cannot escape their intended segment.