VULNERABILITY INTELLIGENCE

CVE-2026-64653

EPSS probability0.51%
CISA KEVNot currently listed
Published2026-08-06
Last modified2026-09-10

Description

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

Weakness classification

  • security-advisories@github.com: CWE-22

Primary references