5.1
Medium
CVE-2026-64653 GitHub CLI (gh) is GitHub’s official command line tool
Description
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| cli 2.97 | earliest → < 2.97.0 | 2.97.0 |
Other CVEs of cli
The 12 CVEs of cli →
CVE-2026-72924
GitHub CLI (gh) is GitHub's official command line tool
2.1
Low
CVE-2026-64655
GitHub CLI (gh) is GitHub’s official command line tool
2.1
Low
CVE-2026-64654
GitHub CLI (gh) is GitHub's official command line tool
5.3
Medium
CVE-2026-64652
GitHub CLI (gh) is GitHub's official command line tool
3.3
Low