go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace

Root

Cause The go-gh Go module, which provides programmatic access to the GitHub CLI and API, contains a vulnerability in its auth.TokenForHost function. In versions prior to 2.11.1, when running inside a GitHub Codespace, the function could incorrectly source an authentication token from the GITHUB_TOKEN environment variable for hosts other than github.com or ghe.com. This design flaw mixed the token intended for GitHub.com with requests made to arbitrary hosts [2].

Exploitation

An attacker who can induce a codespace-based service or script using go-gh to make an HTTP request to a malicious host could receive the GITHUB_TOKEN value. The attack vector is network-based; no authentication to the victim is required beyond the token being present in the environment. Successful exploitation requires that the target process uses auth.TokenForHost while operating in a codespace context [2].

Impact

If exploited, the GITHUB_TOKEN (or its alias GH_TOKEN) is sent to an unintended, potentially attacker-controlled host. This token carries the same access rights as the user who created it, which can include read/write access to repositories, organizations, and enterprise resources. An attacker could use the leaked token to perform unauthorized actions, including accessing private repositories, modifying code, or exfiltrating data [2][4].

Mitigation

The issue is patched in go-gh version 2.11.1, where auth.TokenForHost now only sources the GITHUB_TOKEN variable for GitHub.com and ghe.com hosts. Users should upgrade to this version. Additionally, GitHub advises regenerating all affected tokens and reviewing personal security logs and enterprise audit logs for suspicious activity tied to those tokens [2][3].