github.com/cli/cli/v2 vulnerabilities

CVEs whose affected-version data names the github.com/cli/cli/v2 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-64653Low

2mo ago

GitHub CLI (gh) is GitHub’s official command line tool

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource…

▾ Sunlitcli · github.com/cli/cli/v2EPSS 0.51%via NVD

CVE-2026-64652Low· 3.3

2mo ago

GitHub CLI (gh) is GitHub's official command line tool

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part …

▾ Sunlitcli · github.com/cli/cli/v2EPSS 0.15%via NVD

CVE-2026-64655Low

2mo ago

GitHub CLI (gh) is GitHub’s official command line tool

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex meta…

▾ Sunlitcli · github.com/cli/cli/v2EPSS 0.34%via NVD

CVE-2024-54132Medium

1y ago

Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability

▾ Sunlitcli · github.com/cli/cli/v2EPSS 0.63%via OSV