{"id":"CVE-2026-64653","aliases":["AZL-95465","DEBIAN-CVE-2026-64653","EUVD-2026-54213","GHSA-4fjg-2h4q-fwg3","GO-2026-6765","UBUNTU-CVE-2026-64653","openSUSE-SU-2026:11530-1","openSUSE-SU-2026:21663-1"],"status":"published","title":"GitHub CLI: Unescaped variable components in request URLs could allow path traversal","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00511,"percentile":0.43887,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-06T17:51:54Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Go","package":"github.com/cli/cli/v2","fixed_in":["2.97.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.97.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0+dfsg1-1","2.24.3+dfsg1-1","2.27.0+dfsg1-1","2.30.0-1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.46.0-1","2.46.0-2","2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4"]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.97.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0+dfsg1-1","2.4.0+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2","2.45.0-1ubuntu0.2+esm1","2.45.0-1ubuntu0.2+esm2","2.45.0-1ubuntu0.3","2.45.0-1ubuntu0.3+esm1","2.45.0-1ubuntu0.3+esm2","2.45.0-1ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.46.0-3","2.46.0-4","2.46.0-4ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.97.0-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.98.0-bp160.1.1"}]}],"bundled":5}],"products":[{"vendor":"cli","product":"cli"}],"references":[{"url":"https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/cli/cli/releases/tag/v2.97.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64653","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4fjg-2h4q-fwg3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64653.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64653","tags":["advisory"]},{"url":"https://github.com/cli/cli","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-64653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64653","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64655","tags":["web"]},{"url":"https://bugzilla.suse.com/1266618","tags":["report"]},{"url":"https://bugzilla.suse.com/1276661","tags":["report"]},{"url":"https://bugzilla.suse.com/1276662","tags":["report"]},{"url":"https://bugzilla.suse.com/1276663","tags":["report"]},{"url":"https://bugzilla.suse.com/1276664","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64653","title":"GitHub CLI: Unescaped variable components in request URLs could allow path traversal","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T17:51:54.344Z","modified":"2026-08-07T14:54:13.12Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-54213","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T17:51:54Z","modified":"2026-08-07T14:54:13Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:07.294457Z"}],"ghsa":[{"id":"GHSA-4fjg-2h4q-fwg3","title":"GitHub CLI allows path traversal through unescaped request URL components","description":"### Summary\n\nA path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause `gh` to address a different resource than intended.\n\n### Details\n\nNot all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.\n\nIn `2.97.0`, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.\n\n### Impact\n\nAn attacker who can control a value that flows into a request path can cause `gh` to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.97.0`.\n2. Be cautious when running `gh` against untrusted repositories or inputs whose names you do not control.","status":"published","published":"2026-10-15T18:07:14Z","modified":"2026-10-15T18:07:18Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-64653","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13.237Z","modified":"2026-09-10T20:36:14.34Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-64653","title":"GitHub CLI: Unescaped variable components in request URLs could allow path traversal","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T17:51:54.344Z","modified":"2026-10-28T02:31:08.505908775Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"DEBIAN-CVE-2026-64653","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13.237Z","modified":"2026-10-01T03:03:48.078504747Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"GHSA-4fjg-2h4q-fwg3","title":"GitHub CLI allows path traversal through unescaped request URL components","description":"### Summary\n\nA path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause `gh` to address a different resource than intended.\n\n### Details\n\nNot all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.\n\nIn `2.97.0`, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.\n\n### Impact\n\nAn attacker who can control a value that flows into a request path can cause `gh` to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.97.0`.\n2. Be cautious when running `gh` against untrusted repositories or inputs whose names you do not control.","status":"published","published":"2026-10-15T18:07:14Z","modified":"2026-10-19T21:40:57.702450779Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"UBUNTU-CVE-2026-64653","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:00Z","modified":"2026-10-17T12:59:16.727248329Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"AZL-95465","title":"CVE-2026-64653 affecting package gh for versions less than 2.97.0-1","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","status":"published","published":"2026-08-06T22:18:13Z","modified":"2026-09-10T14:16:46.492388262Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"GO-2026-6765","title":"GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli","description":"GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli","status":"published","published":"2026-10-19T21:08:35Z","modified":"2026-10-19T21:31:53.420127909Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:11530-1","title":"gh-2.97.0-1.1 on GA media","description":"These are all security issues fixed in the gh-2.97.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-18T09:30:04.589760252Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21663-1","title":"Security update for gh","description":"This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.98.0:\n  * chore: fix extra whitespace\n  * Default Codespaces port forwarding to loopback\n  * Bump gh-aw-actions to v0.87.1 and recompile workflows\n  * Fix issue triage action compatibility\n  * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0\n  * chore: bump go to 1.26.7 (#14205)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1\n  * Revert \"ci: add temporary step to verify Linux repo signing keys\"\n  * ci: add temporary step to verify Linux repo signing keys\n  * Accept pre-release tags in deployment validation (#14193)\n  * chore: sign APT repositories with both keys\n  * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6\n  * chore(deps): bump the aw-actions group with 2 updates\n  * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2\n  * Bump Go to 1.26.6\n  * Upgrade gh-aw workflows to v0.85.4\n  * chore(deps): bump github.com/google/go-containerregistry\n  * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12\n  * Address review: drop cleanup markers, document search-type in skill\n  * Reconcile feature detection cleanup comment rules in AGENTS.md\n  * Update AGENTS.md with cleanup comment guidance\n  * Address review feedback\n  * Add --search-type flag for semantic and hybrid issue search\n  * Rename config mock constructors to match repo convention\n  * Document when to use the config mock or the isolated config\n  * Accept config content in NewIsolatedTestConfig\n  * Clear auth environment variables in isolated test config\n  * Isolate git config in tests that shell out to git\n  * Rename config stub file to test.go\n  * chore(deps): bump the aw-actions group with 2 updates\n  * Add aw-actions group to dependabot configuration\n  * Rename cli-code-reviewer skill to code-review (#14116)\n  * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4\n  * Reduce item-add test diff\n  * Isolate item-add test mocks\n  * Test item-add output through command path\n  * Run lint workflow when the lint workflow changes\n  * Bump golangci-lint in CI to v2.12.2\n  * Clarify PR testing section expectations\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump azure/login from 3.0.0 to 3.0.1\n  * chore(deps): bump actions/attest from 4.2.1 to 4.2.2\n  * Use reflect.Pointer instead of deprecated reflect.Ptr\n  * Add a scheduled tech debt burndown skill (#14095)\n  * Restore automatic spam issue closure (#14088)\n  * Give Dependabot triage a real reachability check (#14087)\n  * Route release deletions through api.Client (#14077)\n  * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0\n  * chore(deps): bump github.com/google/go-containerregistry\n  * Grant the gate the scopes its CI read needs\n  * Keep pre-flight dedup out of the integrity proxy\n  * Key direct/indirect off the // indirect comment\n  * Gate triager confidence on required evidence\n  * Gate Dependabot triage on deterministic pre-flight check\n  * Set GH_EXTENSION=1 when gh invokes an extension\n  * Tell agents to use the PR template in AGENTS.md\n  * Merge pull request #14062 from cli/williammartin-wp-08-release-create\n  * Route extension requests through api.Client (#14059)\n  * Route autolink requests through api.Client (#14013)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * fix(release create): trim spaces when parsing X-Oauth-Scopes\n  * Match worktree rev-parse stub against absolute path on Windows\n  * fix(pr/checkout): pass -- before worktree path so dash paths work\n  * docs(pr/checkout): add worktree usage example to help text\n  * docs(skills): mention pr checkout worktree support\n  * chore(pr checkout): polish worktree related tests\n  * Route gpg key requests through api.Client (#13997)\n  * Use generated key in ssh-key acceptance test\n  * Route ssh key requests through api.Client\n  * Fix item-add output for non-TTY\n  * test(pr/checkout): add acceptance tests for worktree checkout\n  * chore(deps): bump actions/attest from 4.2.0 to 4.2.1\n  * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0\n  * Generate unique acceptance SSH keys\n  * Route deploy key requests through api.Client\n  * Collapse spam triage into the agentic issue-triage workflow (#14027)\n  * Run Dependabot triage hourly\n  * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5\n  * Require explicit PR review ownership (#14028)\n  * Slim down dependabot triage comments (#14019)\n  * Wrap RESTWithNext errors as api.HTTPError\n  * Bail out early on unusable --worktree paths\n  * Clarify current-worktree rejection message\n  * Return ok bool from revParseFacts to satisfy nilerr\n  * Drop docs on self-explanatory worktree helpers\n  * Trim redundant comments and clarify worktree field names\n  * Resolve worktree target once instead of re-querying git\n  * Fix worktree toplevel stub to match Windows absolute paths\n  * Detect worktrees via git rev-parse and reject the current worktree\n  * Address review: restore TODO, flatten detachCmds, guard worktree symlink\n  * Cover detach-reuse, worktree fetch dir, and symlink path resolution\n  * Harden worktree submodule prefixing and cover cmd.Dir stripping\n  * Create branch when reusing a worktree with a new --branch name\n  * Extract authenticatedCommand helper to dedupe -C handling\n  * Preserve no-force safety when reusing a worktree for fork PRs\n  * Simplify submodule worktree prefix to inline conditional\n  * Run submodule commands inside the worktree for pr checkout\n  * tidying..\n  * Refine PR checkout worktree flag help\n  * Add --worktree flag to gh pr checkout\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only\n  Punycode-encoded labels allows for validation bypass and privilege\n  escalation (bsc#1266618).\n\n- Update to version 2.97.0, fixing four security issues (CVE-2026-64654, bsc#1276662,\n  CVE-2026-64653, bsc#1276664, CVE-2026-64652, bsc#1276663, CVE-2026-64655, bsc#1276661):\n  * CVE-2026-64654: terminal escape sequence injection in gist view, api,\n    pr diff, release download --output -, codespace logs, skills preview\n    and agent-task view/create\n  * CVE-2026-64653: unescaped variable path components in request URLs\n    could redirect gh to a different resource than intended\n  * CVE-2026-64652: gh auth status could print part of the auth token in\n    plaintext for token types with an underscore after the prefix\n  * CVE-2026-64655: gh attestation verify built its --signer-repo/\n    --signer-workflow matcher without escaping regex metacharacters,\n    allowing a lookalike signer to pass verification\n  * Add named field columns to gh project item-list and item-edit\n","status":"published","published":"2026-08-26T16:15:07Z","modified":"2026-08-27T17:30:03.684853288Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}