GHSA-4fjg-2h4q-fwg3 GitHub CLI allows path traversal through unescaped request URL components

• Go github.com/cli/cli/v2: < 2.97.0 → fixed in 2.97.0

Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause `gh` to address a different resource than intended. Details Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path. In `2.97.0`, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment. Impact An attacker who can control a value that flows into a request path can cause `gh` to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target. Remediation and Mitigation 1. Upgrade `gh` to `2.97.0`. 2. Be cautious when running `gh` against untrusted repositories or inputs whose names you do not control.