{"id":"CVE-2026-64655","kind":"vulnerability","aliases":["CVE-2026-64655","GHSA-mm27-mwq9-fr5g","GO-2026-6767"],"related":[],"title":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.","summary":"The GitHub CLI's attestation verify command treats the --signer-repo and --signer-workflow values as regular expressions, so a dot in a name matches any character. An attacker who registers a lookalike repository or workflow name can get a signed attestation accepted as coming from a trusted signer.","severity":"low","cvss":2.1,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cli/cli","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/cli/cli/v2","fixed":["2.97.0"],"affected":"< 2.97.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci-cd","github-cli","go","package","supply-chain-verification"],"not_affected_if":["fixed-version-installed","no-attestation-verify-use"],"how_to_check":"Run gh --version; versions before 2.97.0 are affected. Check CI and policy scripts for gh attestation verify with --signer-repo or --signer-workflow.","fix":"Upgrade gh to 2.97.0 or later; for the Go module, github.com/cli/cli/v2 at 2.97.0 or later.","status":"open","published_at":"2026-08-06T22:18:13+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:27+00:00","updated_at":"2026-10-23T21:49:27+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:49:27Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade gh to 2.97.0 or later; for the Go module, github.com/cli/cli/v2 at 2.97.0 or later.","reach":"internet","impact":"medium","summary":"The GitHub CLI's attestation verify command treats the --signer-repo and --signer-workflow values as regular expressions, so a dot in a name matches any character. An attacker who registers a lookalike repository or workflow name can get a signed attestation accepted as coming from a trusted signer.","category":"package","who_cares":["github-cli","ci-cd","supply-chain-verification","go"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attestation check passes for a lookalike signer repo, undermining supply chain trust.","analyst_note":"","how_to_check":"Run gh --version; versions before 2.97.0 are affected. Check CI and policy scripts for gh attestation verify with --signer-repo or --signer-workflow.","needs_analyst":false,"not_affected_if":["no-attestation-verify-use","fixed-version-installed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00094,"input_tokens":3184,"output_tokens":1244,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A,27A '-64655':17A,28A '-6767':25A '/cli/cli':14A,31A '/cli/cli/v2':34A '2.97.0':110C,243C 'accept':91B 'allow':3A 'altern':118C 'attack':77B,175C,204C 'attest':4A,51B,90B,112C,199C,214C 'build':114C 'bypass':6A,195C 'cd':37B 'certif':116C 'chain':45B,221C 'charact':75B,159C 'ci':36B 'ci-cd':35B 'ci/cd':224C 'cli':2A,40B,49B,99C 'come':93B 'command':53B,105C 'could':218C 'creat':206C 'cve':15A,26A 'differ':191C 'dot':69B 'escap':133C 'exampl':182C 'exploit':201C 'express':66B,150C 'fix':240C 'flag':130C 'fr5g':22A 'gate':228C 'get':87B 'gh':100C,111C 'ghsa':19A 'ghsa-mm27-mwq9-fr5g':18A 'github':1A,39B,48B,98C,102C,157C 'github-c':38B 'github.com':13A,30A,33A 'github.com/cli/cli':12A,29A 'github.com/cli/cli/v2':32A 'github/artifact-attestations-workflows':194C 'github/artifact.attestations-workflows':183C 'go':23A,41B 'intend':188C,197C 'issu':238C 'line':106C 'liter':154C 'lookalik':81B,179C,209C 'match':73B 'matcher':120C,187C 'metacharact':10A,135C 'mm27':20A 'mwq9':21A 'name':72B,85B,119C,144C,168C,180C 'offici':104C 'organ':163C 'packag':42B 'path':167C 'permit':158C 'pin':230C 'pipelin':225C 'plausibl':208C 'polici':227C 'prior':108C 'produc':212C 'rather':151C 'regex':9A,134C,172C 'regist':79B,177C 'regular':65B,149C 'repo':58B,125C 'repositori':82B,141C,164C,210C 'requir':202C 'satisfi':185C 'sign':89B,235C 'signer':57B,61B,97B,124C,128C,193C 'signer-repo':56B,123C 'signer-workflow':60B,127C 'sigstor':198C 'specif':234C 'string':155C 'subject':117C 'suppli':44B,140C,220C 'supply-chain-verif':43B 'tool':107C 'treat':54B,146C 'trust':96B,192C,231C 'undermin':219C 'unescap':8A 'user':139C 'user-suppli':138C 'valid':213C 'valu':63B,131C 'verif':5A,46B,200C,222C 'verifi':52B,113C 'version':242C 'wildcard':173C 'without':132C 'workflow':62B,84B,129C,143C,166C,236C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-06T22:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6767","url":"https://pkg.go.dev/vuln/GO-2026-6767","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-64655","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64655","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-64655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64655","severity":null,"published_at":"2026-08-06T22:18:13+00:00","modified_at":"2026-09-10T20:36:14+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}