Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M

CVE-2026-64653GitHub CLI: Unescaped variable components in request URLs could allow path traversal

Medium 5.1

In plain English

A medium-severity path traversal in cli from cli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	gh	no fix listed	DEBIAN-CVE-2026-64653
Debian:13	gh	no fix listed	DEBIAN-CVE-2026-64653
Go	github.com/cli/cli	no fix listed	GO-2026-6765
Go	github.com/cli/cli/v2	2.97.0	GO-2026-6765
Go	github.com/cli/cli/v2	2.97.0	GHSA-4fjg-2h4q-fwg3
Ubuntu:22.04:LTS	gh	no fix listed	UBUNTU-CVE-2026-64653
Ubuntu:26.10	gh	no fix listed	UBUNTU-CVE-2026-64653

Affected products (as reported)

Vendor	Product	Versions
cli	cli	< 2.97.0

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 x_refsource_CONFIRM
https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06 x_refsource_MISC
https://github.com/cli/cli/releases/tag/v2.97.0 x_refsource_MISC