CVE-2024-53859 — Sensitive Information Exposure in CLI Go-gh V2
Severity
7.5HIGHNVD
EPSS
0.1%
top 82.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 27
Latest updateMar 20
Description
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Ent…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages5 packages
🔴Vulnerability Details
5OSV▶
Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh↗2024-12-12
OSV▶
CVE-2024-53859: go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line↗2024-11-27
OSV▶
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace↗2024-11-27
GHSA▶
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace↗2024-11-27