Evidence · DiggingBeagle record
GHSA-9jxf-w4wc-5g93: sandbox credential sidecar exfiltration
Primary advisory with two distinct routes from sandbox code to a credential-bearing proxy and its GitHub token.
- Source role
- primary disclosure
Evidence record
Primary advisory with two distinct routes from sandbox code to a credential-bearing proxy and its GitHub token.
Claim-level citations (2)
- supportsgh-aw API proxy URL parsing forwarded job credentials to an external host: The gh-aw MCP gateway URL construction allowed a malformed API path to become a URL whose effective host was an attacker-selected destination, with api.github.com parsed as user information.
Description, issue 2 malformed /api/v3 path; Resolution
- supportsgh-aw sandbox controlled a credential sidecar browser command: The gh-aw CLI proxy accepted a caller-provided GH_BROWSER environment value and used it when running gh browse in a credential-holding sidecar.
Description, issue 1 GH_BROWSER; Resolution and patched-version metadata