GitHub CLI allows path traversal through unescaped request URL components

Summary

A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to address a different resource than intended.

Details

Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.

In 2.97.0, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.

Impact

An attacker who can control a value that flows into a request path can cause gh to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.

Remediation and Mitigation

1. Upgrade gh to 2.97.0.
2. Be cautious when running gh against untrusted repositories or inputs whose names you do not control.