Vulnerability Description
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
Related Weaknesses (CWE)
References
- https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06
- https://github.com/cli/cli/releases/tag/v2.97.0
- https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3
FAQ
What is CVE-2026-64653?
CVE-2026-64653 is a documented vulnerability. GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attac...
How severe is CVE-2026-64653?
CVSS scoring is not yet available for CVE-2026-64653. Check NVD for updates.
Is there a patch for CVE-2026-64653?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.