CVE-2026-64654

Received Received - Intake

Terminal Escape Sequence Injection in GitHub CLI

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-64654

Affected Vendors & Products

Vendor	Product	Version / Range
github	github_cli	to 2.97.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

GitHub CLI (gh) versions before 2.97.0 have a vulnerability where certain commands print externally controlled content without removing terminal escape sequences. Attackers can embed malicious escape sequences in content like gists or pull requests, which may manipulate terminal display or execute commands when viewed by users.

Detection Guidance

Detect this vulnerability by checking the installed version of GitHub CLI. Run 'gh version' in the terminal. If the version is below 2.97.0, the system is vulnerable.

Impact Analysis

If you use an affected GitHub CLI version, an attacker could trick you into running a malicious command by embedding escape sequences in content you view. This could lead to unauthorized actions, data theft, or system compromise depending on terminal emulator behavior.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is accessed or exfiltrated. Organizations must ensure CLI tools are updated to mitigate such risks.

Mitigation Strategies

Upgrade GitHub CLI to version 2.97.0 or later immediately. Use your package manager to update, e.g., 'sudo apt update && sudo apt upgrade gh' for Debian-based systems or 'brew upgrade gh' for macOS.

Hi! I’m here to help you understand CVE-2026-64654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70