CVE-2026-64653CWE-22path-traversal

CVE-2026-64653

published August 7, 2026

CVSS
5.1
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-07T02:18Z
References (3)
https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06 · [email protected]https://github.com/cli/cli/releases/tag/v2.97.0 · [email protected]https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 · [email protected]
EPSS history
Timeline
  • 06 AUG 17:51Z
    GitHub CLI: Unescaped variable components in request URLs could allow path traversal
    cvelistv5