CVE-2026-64653

Received Received - Intake

GitHub CLI Path Traversal Vulnerability

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-64653

Affected Vendors & Products

Vendor	Product	Version / Range
github	github_cli	2.97.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

GitHub CLI (gh) versions before 2.97.0 have a flaw where HTTP request URLs insert variable path components without proper percent encoding. This allows attackers to manipulate repository or resource values to redirect gh to unintended API endpoints or resources.

Detection Guidance

This vulnerability involves GitHub CLI (gh) versions prior to 2.97.0 improperly handling URL path components. To detect it, check the installed version of gh using the command: gh --version. If the version is below 2.97.0, the system is vulnerable.

Impact Analysis

An attacker could trick you into interacting with a different API endpoint than intended, potentially leading to unauthorized actions, data leaks, or misinformation being displayed or processed by gh.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality requirements in GDPR or HIPAA. Organizations using vulnerable gh versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade GitHub CLI to version 2.97.0 or later immediately. Use the command: gh upgrade to update to the latest version. Avoid using vulnerable versions for any operations involving untrusted repositories or resources.

Hi! I’m here to help you understand CVE-2026-64653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70