chore(deps): update module github.com/cli/go-gh/v2 to v2.12.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/cli/go-gh/v2	v2.0.1 -> v2.12.1

GitHub Vulnerability Alerts

CVE-2024-53859

Summary

A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace.

Details

go-gh sources authentication tokens from different environment variables depending on the host involved:

• GITHUB_TOKEN, GH_TOKEN for GitHub.com and ghe.com
• GITHUB_ENTERPRISE_TOKEN, GH_ENTERPRISE_TOKEN for GitHub Enterprise Server

Prior to 2.11.1, auth.TokenForHost could source a token from the GITHUB_TOKEN environment variable for a host other than GitHub.com or ghe.com when within a codespace.

In 2.11.1, auth.TokenForHost will only source a token from the GITHUB_TOKEN environment variable for GitHub.com or ghe.com hosts.

Impact

Successful exploitation could send authentication token to an unintended host.

Remediation and mitigation

1. Upgrade go-gh to 2.11.1
2. Advise extension users to regenerate authentication tokens:
   • Personal access tokens
   • GitHub CLI OAuth app
3. Advise extension users to review their personal security log and any relevant audit logs for actions associated with their account or enterprise

CVE-2025-48938

Summary

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

Details

The GitHub CLI and CLI extensions allow users to transition from their terminal for a variety of use cases through the Browser capability in github.com/cli/go-gh/v2/pkg/browser:

• Using the -w, --web flag, GitHub CLI users can view GitHub repositories, issues, pull requests, and more using their web browser
• Using the gh codespace command set, GitHub CLI users can transition to Visual Studio Code to work with GitHub Codespaces

This is done by using URLs provided through API responses from authenticated GitHub hosts when users execute gh commands.

Prior to 2.12.1, Browser.Browse() would attempt to open the provided URL using a variety of OS-specific approaches regardless of the scheme. An attacker-controlled GitHub Enterprise Server could modify API responses to use a specially tailored local executable path instead of HTTP URLs to resources. This could allow the attacker to execute arbitrary executables on the user's machine.

In 2.12.1, Browser.Browse() has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs:

1. URLs with http://, https://, vscode://, vscode-insiders:// protocols are supported
2. URLs with file:// protocol are unsupported
3. URLs matching files or directories on the filesystem are unsupported
4. URLs matching executables in the user's path are unsupported

URLs without protocols will be browsable if none of these other conditions apply.

As we have more information about use cases, maintainers can expand these capabilities for an improved user experience that allows configuring allowed URL schemes and/or prompt the user for an unexpected user case and confirming whether to continue.

Impact

Successful exploitation could cause users of the attacker-controlled GitHub Enterprise Server to execute arbitrary commands.

Remediation and Mitigation

1. Upgrade go-gh to 2.12.1

---

auth.TokenForHost violates GitHub host security boundary when sourcing authentication token within a codespace

CVE-2024-53859 / GHSA-55v3-xh23-96gh / GO-2024-3295

More information

Details

Summary

A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace.

Details

go-gh sources authentication tokens from different environment variables depending on the host involved:

• GITHUB_TOKEN, GH_TOKEN for GitHub.com and ghe.com
• GITHUB_ENTERPRISE_TOKEN, GH_ENTERPRISE_TOKEN for GitHub Enterprise Server

Prior to 2.11.1, auth.TokenForHost could source a token from the GITHUB_TOKEN environment variable for a host other than GitHub.com or ghe.com when within a codespace.

In 2.11.1, auth.TokenForHost will only source a token from the GITHUB_TOKEN environment variable for GitHub.com or ghe.com hosts.

Impact

Successful exploitation could send authentication token to an unintended host.

Remediation and mitigation

1. Upgrade go-gh to 2.11.1
2. Advise extension users to regenerate authentication tokens:
   • Personal access tokens
   • GitHub CLI OAuth app
3. Advise extension users to review their personal security log and any relevant audit logs for actions associated with their account or enterprise

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

References

• https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh
• https://nvd.nist.gov/vuln/detail/CVE-2024-53859
• https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps
• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log
• https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token
• https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
• https://github.com/cli/go-gh
• https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go#L73-L77
• https://pkg.go.dev/vuln/GO-2024-3295

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh

CVE-2024-53859 / GHSA-55v3-xh23-96gh / GO-2024-3295

More information

Details

Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh

Severity

Unknown

References

• https://github.com/cli/go-gh/security/advisories/GHSA-55v3-xh23-96gh
• https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps
• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log
• https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token
• https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
• https://github.com/cli/go-gh/blob/71770357e0cb12867d3e3e288854c0aa09d440b7/pkg/auth/auth.go#L73-L77

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

CVE-2025-48938 / GHSA-g9f5-x53j-h563 / GO-2025-3732

More information

Details

Summary

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

Details

The GitHub CLI and CLI extensions allow users to transition from their terminal for a variety of use cases through the Browser capability in github.com/cli/go-gh/v2/pkg/browser:

• Using the -w, --web flag, GitHub CLI users can view GitHub repositories, issues, pull requests, and more using their web browser
• Using the gh codespace command set, GitHub CLI users can transition to Visual Studio Code to work with GitHub Codespaces

This is done by using URLs provided through API responses from authenticated GitHub hosts when users execute gh commands.

Prior to 2.12.1, Browser.Browse() would attempt to open the provided URL using a variety of OS-specific approaches regardless of the scheme. An attacker-controlled GitHub Enterprise Server could modify API responses to use a specially tailored local executable path instead of HTTP URLs to resources. This could allow the attacker to execute arbitrary executables on the user's machine.

In 2.12.1, Browser.Browse() has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs:

1. URLs with http://, https://, vscode://, vscode-insiders:// protocols are supported
2. URLs with file:// protocol are unsupported
3. URLs matching files or directories on the filesystem are unsupported
4. URLs matching executables in the user's path are unsupported

URLs without protocols will be browsable if none of these other conditions apply.

As we have more information about use cases, maintainers can expand these capabilities for an improved user experience that allows configuring allowed URL schemes and/or prompt the user for an unexpected user case and confirming whether to continue.

Impact

Successful exploitation could cause users of the attacker-controlled GitHub Enterprise Server to execute arbitrary commands.

Remediation and Mitigation

1. Upgrade go-gh to 2.12.1

Severity

Moderate

References

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://nvd.nist.gov/vuln/detail/CVE-2025-48938
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
• https://github.com/cli/go-gh

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh

CVE-2025-48938 / GHSA-g9f5-x53j-h563 / GO-2025-3732

More information

Details

GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh

Severity

Unknown

References

• https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
• https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

cli/go-gh (github.com/cli/go-gh/v2)

v2.12.1

Compare Source

Security

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

For more information, see GHSA-g9f5-x53j-h563

Full Changelog: cli/go-gh@v2.12.0...v2.12.1

v2.12.0

Compare Source

Introducing experimental support for rendering markdown with customizable, accessible colors

Users with low vision or color blindness rely upon the terminal's ability to change how colors appear, however this requires CLIs to use a limited set of colors:

The markdown rendered for GitHub CLI and extensions defaults to 8-bit colors that users cannot easily customize in this way.

Now, users can force rendered markdown to use customizable, accessible colors by doing one of the following:

1. Set GH_ACCESSIBLE_COLORS environment variable to a truthy value

   export GH_ACCESSIBLE_COLORS=1

2. Set accessible_colors configuration setting

   gh config set accessible_colors enabled

Experimental.accessible.markdown.colors.mp4

Users with a customcharmbracelet/glamour style will continue to have markdown rendered using it.

For more information, see https://github.com/cli/go-gh/pull/186

Introducing new experimental github.com/cli/go-gh/v2/pkg/x package

cli/go-gh provides capabilities used by both the GitHub CLI and CLI extensions. Some of these packages are stable, however some like the new experimental markdown support are not.

The github.com/cli/go-gh/v2/pkg/x package has been created to contain experimental features that are subject to change without notice.

Introducing new string matcher functions for Go templates

The following string matcher functions from Masterminds/sprig have been incorporated for more robust Go template support in GitHub CLI and CLI extensions:

• contains
• hasPrefix
• hasSuffix
• regexMatch

For more information, see https://github.com/cli/cli/issues/6370 and sprig documentation

What's Changed

✨ Features

• Integrate sprig library by @​iamazeem in https://github.com/cli/go-gh/pull/184
• Introduce experimental accessible colors in markdown rendering by @​andyfeller in https://github.com/cli/go-gh/pull/186

New Contributors

• @​iamazeem made their first contribution in https://github.com/cli/go-gh/pull/184

Full Changelog: cli/go-gh@v2.11.2...v2.12.0

v2.11.2

Compare Source

What's Changed

• Bump golang.org/x/net to resolve Dependabot alerts by @​BagToad in https://github.com/cli/go-gh/pull/176

New Contributors

• @​BagToad made their first contribution in https://github.com/cli/go-gh/pull/176

Full Changelog: cli/go-gh@v2.11.1...v2.11.2

v2.11.1

Compare Source

Security

• A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace.

  For more information, see GHSA-55v3-xh23-96gh

Full Changelog: cli/go-gh@v2.11.0...v2.11.1

v2.11.0

Compare Source

What's Changed

• Replace duplicated IsEnterprise and IsTenancy functions in api pkg with auth pkg by @​jtmcg in https://github.com/cli/go-gh/pull/173

New Contributors

• @​jtmcg made their first contribution in https://github.com/cli/go-gh/pull/173

Full Changelog: cli/go-gh@v2.10.0...v2.11.0

v2.10.0

Compare Source

What's Changed

• Use api subdomain for REST and GQL clients when host is tenant by @​williammartin in https://github.com/cli/go-gh/pull/172

Full Changelog: cli/go-gh@v2.9.0...v2.10.0

v2.9.0

Compare Source

What's Changed

• Allow reuse of host checks for extension authors by @​andyfeller in https://github.com/cli/go-gh/pull/152
• Use lipgloss.Width to calculate DisplayWidth by @​maaslalani in https://github.com/cli/go-gh/pull/159

New Contributors

• @​andyfeller made their first contribution in https://github.com/cli/go-gh/pull/152
• @​maaslalani made their first contribution in https://github.com/cli/go-gh/pull/159

Full Changelog: cli/go-gh@v2.8.0...v2.9.0

v2.8.0

Compare Source

What's Changed

• jq: bump up gojq, better query parse error, handle halt error gracefully by @​itchyny in https://github.com/cli/go-gh/pull/155
• Bump glamour to v0.7.0 and go mod tidy by @​williammartin in https://github.com/cli/go-gh/pull/156

Full Changelog: cli/go-gh@v2.7.0...v2.8.0

v2.7.0

Compare Source

What's Changed

• Attempt to use user configured dirs for caching by @​williammartin in https://github.com/cli/go-gh/pull/153

Full Changelog: cli/go-gh@v2.6.0...v2.7.0

v2.6.0

Compare Source

What's Changed

• Treat tenancy as non enterprise by @​williammartin in https://github.com/cli/go-gh/pull/151

Full Changelog: cli/go-gh@v2.5.0...v2.6.0

v2.5.0

Compare Source

What's Changed

• Add header support to tableprinter by @​heaths in https://github.com/cli/go-gh/pull/139
• Remove default configuration and add fallback configuration by @​samcoe in https://github.com/cli/go-gh/pull/142
• Add support to config for setting and writing blank values by @​samcoe in https://github.com/cli/go-gh/pull/143
• Fix sanitization bug by @​samcoe in https://github.com/cli/go-gh/pull/145
• Config should load as unmodified by @​williammartin in https://github.com/cli/go-gh/pull/147

New Contributors

• @​williammartin made their first contribution in https://github.com/cli/go-gh/pull/147

Full Changelog: cli/go-gh@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

• Fix a typo in the doc of WithTheme by @​y-yagi in https://github.com/cli/go-gh/pull/134
• Update workflows to use actions/checkout@v4 by @​samcoe in https://github.com/cli/go-gh/pull/136
• Update dependencies to address security vulnerability by @​samcoe in https://github.com/cli/go-gh/pull/137
• Update dependency to address security vulnerability by @​samcoe in https://github.com/cli/go-gh/pull/140

New Contributors

• @​y-yagi made their first contribution in https://github.com/cli/go-gh/pull/134

Full Changelog: cli/go-gh@v2.3.0...v2.4.0

v2.3.0: go-gh 2.3.0

Compare Source

What's Changed

• Upgrade to Go 1.21 by @​samcoe in https://github.com/cli/go-gh/pull/129
• Implement prompter package by @​samcoe in https://github.com/cli/go-gh/pull/131

Full Changelog: cli/go-gh@v2.2.0...v2.3.0

v2.2.0: go-gh 2.2.0

Compare Source

What's Changed

• Add CacheDir function to config package by @​ffalor in https://github.com/cli/go-gh/pull/126
• Fix bug in asciisanitizer with valid U+FFFD character being reported as an error by @​yin1999 in https://github.com/cli/go-gh/pull/128

New Contributors

• @​ffalor made their first contribution in https://github.com/cli/go-gh/pull/126
• @​yin1999 made their first contribution in https://github.com/cli/go-gh/pull/128

Full Changelog: cli/go-gh@v2.1.0...v2.2.0

v2.1.0: go-gh 2.1.0

Compare Source

What's Changed

• Add missing import statement to code example by @​bendrucker in https://github.com/cli/go-gh/pull/124
• Export Path function from top level gh package by @​samcoe in https://github.com/cli/go-gh/pull/123
• Add asciisanitizer package and sanitization to http clients by @​samcoe in https://github.com/cli/go-gh/pull/125

New Contributors

• @​bendrucker made their first contribution in https://github.com/cli/go-gh/pull/124

Full Changelog: cli/go-gh@v2.0.1...v2.1.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.20 -> 1.23.0
golang.org/x/crypto	v0.9.0 -> v0.35.0
golang.org/x/net	v0.10.0 -> v0.36.0
golang.org/x/sys	v0.8.0 -> v0.31.0