CVE-2026-64655

Summary

A security vulnerability has been identified in GitHub CLI that could allow attestation verification bypass when using gh attestation verify with --signer-repo or --signer-workflow flags. GitHub CLI builds the certificate matcher from these flag values without escaping regex metacharacters, so a repository or workflow name is treated as a regular expression rather than a literal string. GitHub permits characters such as  .  in organization, repository, and workflow path names, and  .  is a regex wildcard, so a malicious actor can create a lookalike name that satisfies a matcher intended for a different, trusted signer.

Details

GitHub CLI constructs a regular expression from the  --signer-repo  and  --signer-workflow  values and matches it against the signing certificate's SAN (Subject Alternative Name) during Sigstore attestation verification. The user-supplied value is interpolated into the pattern without escaping regex metacharacters, so any metacharacter permitted in a GitHub path is interpreted as regex syntax instead of a literal character.

The most practical case is  . , which GitHub allows in org/repo names and is a regex wildcard meaning "any single character." For example, an attacker-controlled repository named:

github/artifact.attestations-workflows

matches a verifier configured for the trusted signer:

github/artifact-attestations-workflows

because the unescaped  .  in the constructed pattern matches the  -  in the attacker's name (and any other single character at that position). This affected the --signer-repo and --signer-workflow flags but did not affect the --repo and --owner flags which include an exact string comparison.

In v2.97.0, the GitHub CLI escapes the user-supplied signer values before they are incorporated into the SAN matcher, so they are matched as literal strings.

Impact

The practical impact is limited, exploitation requires the attacker to create a plausible lookalike repository name and produce valid Sigstore attestations from it. This could undermine supply chain verification for CI/CD pipelines or policy gates that use these flags to pin trust to a specific signing workflow.

Remediation and Mitigation

1. Upgrade gh to v2.97.0 or later, which escapes signer values before matching.
2. As a workaround, use --repo or --owner flags instead of --signer-repo or --signer-workflow where applicable.
3. Manually inspect the signing certificate SAN in attestation output to confirm the signing workflow origin.

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  .  in organization, repository, and workflow path names and  .  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  .  in organization, repository, and workflow path names and  .  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

These are all security issues fixed in the gh-2.97.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gh fixes the following issues:

Changes in gh:

• Update to version 2.98.0:
  • chore: fix extra whitespace
  • Default Codespaces port forwarding to loopback
  • Bump gh-aw-actions to v0.87.1 and recompile workflows
  • Fix issue triage action compatibility
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
  • chore: bump go to 1.26.7 (#14205)
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1
  • Revert "ci: add temporary step to verify Linux repo signing keys"
  • ci: add temporary step to verify Linux repo signing keys
  • Accept pre-release tags in deployment validation (#14193)
  • chore: sign APT repositories with both keys
  • chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6
  • chore(deps): bump the aw-actions group with 2 updates
  • chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
  • Bump Go to 1.26.6
  • Upgrade gh-aw workflows to v0.85.4
  • chore(deps): bump github.com/google/go-containerregistry
  • chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12
  • Address review: drop cleanup markers, document search-type in skill
  • Reconcile feature detection cleanup comment rules in AGENTS.md
  • Update AGENTS.md with cleanup comment guidance
  • Address review feedback
  • Add --search-type flag for semantic and hybrid issue search
  • Rename config mock constructors to match repo convention
  • Document when to use the config mock or the isolated config
  • Accept config content in NewIsolatedTestConfig
  • Clear auth environment variables in isolated test config
  • Isolate git config in tests that shell out to git
  • Rename config stub file to test.go
  • chore(deps): bump the aw-actions group with 2 updates
  • Add aw-actions group to dependabot configuration
  • Rename cli-code-reviewer skill to code-review (#14116)
  • chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4
  • Reduce item-add test diff
  • Isolate item-add test mocks
  • Test item-add output through command path
  • Run lint workflow when the lint workflow changes
  • Bump golangci-lint in CI to v2.12.2
  • Clarify PR testing section expectations
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • chore(deps): bump azure/login from 3.0.0 to 3.0.1
  • chore(deps): bump actions/attest from 4.2.1 to 4.2.2
  • Use reflect.Pointer instead of deprecated reflect.Ptr
  • Add a scheduled tech debt burndown skill (#14095)
  • Restore automatic spam issue closure (#14088)
  • Give Dependabot triage a real reachability check (#14087)
  • Route release deletions through api.Client (#14077)
  • chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0
  • chore(deps): bump github.com/google/go-containerregistry
  • Grant the gate the scopes its CI read needs
  • Keep pre-flight dedup out of the integrity proxy
  • Key direct/indirect off the // indirect comment
  • Gate triager confidence on required evidence
  • Gate Dependabot triage on deterministic pre-flight check
  • Set GH_EXTENSION=1 when gh invokes an extension
  • Tell agents to use the PR template in AGENTS.md
  • Merge pull request #14062 from cli/williammartin-wp-08-release-create
  • Route extension requests through api.Client (#14059)
  • Route autolink requests through api.Client (#14013)
  • chore(deps): bump the codeql-actions group across 1 directory with 3 updates
  • fix(release create): trim spaces when parsing X-Oauth-Scopes
  • Match worktree rev-parse stub against absolute path on Windows
  • fix(pr/checkout): pass -- before worktree path so dash paths work
  • docs(pr/checkout): add worktree usage example to help text
  • docs(skills): mention pr checkout worktree support
  • chore(pr checkout): polish worktree related tests
  • Route gpg key requests through api.Client (#13997)
  • Use generated key in ssh-key acceptance test
  • Route ssh key…