Live › vulnerability › CVE-2026-64653
Go to dashboardGitHub CLI (gh) builds some API request URLs by inserting repository or resource names without percent-encoding them. An attacker who controls those values can redirect gh to a different GitHub API endpoint or resource than the user meant to reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/cli/cli | go | all versions | – |
| github.com/cli/cli/v2 | go | < 2.97.0 | 2.97.0 |
2.97.0v2.97.02.97.0 or later2.97.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-64653")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.