PT-2024-35956 · Github+3 · Go-Gh+3

Ry0Tak · Published 2024-11-27 · Updated 2025-09-22 · CVE-2024-53859

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: go-gh versions prior to 2.11.1

Description: A security issue has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens from different environment variables depending on the host involved: GITHUB TOKEN, GH TOKEN for GitHub.com and ghe.com, and GITHUB ENTERPRISE TOKEN, GH ENTERPRISE TOKEN for GitHub Enterprise Server. Prior to version 2.11.1, auth.TokenForHost could source a token from the GITHUB TOKEN environment variable for a host other than GitHub.com or ghe.com when within a codespace. Successful exploitation could send authentication tokens to an unintended host.

Recommendations: Upgrade go-gh to version 2.11.1. Regenerate authentication tokens, including personal access tokens and GitHub CLI OAuth app tokens. Review personal security logs and any relevant audit logs for actions associated with the account or enterprise.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

AZL-53453

CVE-2024-53859

GHSA-55V3-XH23-96GH

GO-2024-3295

OPENSUSE-SU-2024:14599-1

USN-7362-1

Affected Products

Debian

Linuxmint

Ubuntu

Go-Gh

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53859.json · Exploit
• https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53859 · Security Note
• https://osv.dev/vulnerability/AZL-53453 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14599-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53859 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-53859 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53859 · Security Note
• https://ubuntu.com/security/CVE-2024-53859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55v3-xh23-96gh · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7362-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53859 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3295 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7362-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53859 · Vendor Advisory