Exposure of Sensitive Information to an Unauthorized Actor

Summary

go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for `GitHub.com` and `ghe.com`, and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise Server. In affected versions, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN` environment variable for a host other than `GitHub.com` or `ghe.com` when within a codespace. In version `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for `GitHub.com` or `ghe.com` hosts. Successful exploitation could send an authentication token to an unintended host. Users are also advised to regenerate authentication tokens and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise. This issue affects github.com/cli/go-gh/v2 versions prior to 2.11.1.