---
id: "CVE-2026-64653"
kind: "vulnerability"
aliases: ["CVE-2026-64653", "GHSA-4fjg-2h4q-fwg3", "GO-2026-6765"]
title: "GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli"
severity: "medium"
cvss: 5.1
epss: 0.00511
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/cli/cli", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cli/cli/v2", "fixed": ["2.97.0"], "affected": "< 2.97.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci-scripts", "github-cli", "go", "package"]
not_affected_if: ["no-untrusted-repo-or-resource-input", "version-2.97.0-or-later"]
published_at: "2026-08-06T22:18:13+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:05+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6765", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-64653", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64653", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli

GitHub CLI (gh) builds some API request URLs by inserting repository or resource names without percent-encoding them. An attacker who controls those values can redirect gh to a different GitHub API endpoint or resource than the user meant to reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/cli/cli affected all versions fixed ?
- go:github.com/cli/cli/v2 affected < 2.97.0 fixed 2.97.0

## How to check

Run gh --version and check whether the version is earlier than 2.97.0.
For Go projects, run go list -m github.com/cli/cli/v2 and check for a version below v2.97.0.

## Fix

Upgrade GitHub CLI to 2.97.0 or later.
Rebuild any Go binaries that embed github.com/cli/cli/v2 against 2.97.0 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6765
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-64653
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64653

## From the sources

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_