GHSA-p2h2-3vg9-4p87 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

• Go github.com/cli/cli/v2: < 2.62.0 → fixed in 2.62.0 • Go github.com/cli/cli: < 2.62.0 → fixed in 2.62.0

Summary A security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the `gh codespace ssh` or `gh codespace logs` commands. Details The vulnerability stems from the way GitHub CLI handles SSH connection details when executing commands. When developers connect to remote Codespaces, they typically use a SSH server running within a devcontainer, often provided through the default devcontainer image. GitHub CLI retrieves SSH connection details, such as remote username, which is used in executing `ssh` commands for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. Impact Successful exploitation could lead to arbitrary code execution on the user's workstation, potentially compromising the user's data and system. Remediation and Mitigation 1. Upgrade `gh` to `2.62.0` 2. Exercise caution when using custom devcontainer images, prefer default or pre-built devcontainers from trusted sources.