CVE-2026-64653Low▾ SunlitGitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.5%
none → low
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/cli/cli/v2 < 2.97.0Patched in:
github.com/cli/cli/v2 2.97.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64652Low· 3.3GitHub CLI (gh) is GitHub's official command line tool
CVE-2026-64655LowGitHub CLI (gh) is GitHub’s official command line tool
CVE-2024-54132MediumDownloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
CVE-2026-64654Medium· 5.3GitHub CLI (gh) is GitHub's official command line tool
CVE-2024-53859Medium· 6.5`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
CVE-2022-37906Medium· 6.5An authenticated path traversal vulnerability exists in the ArubaOS command line interface