Vulnerabilities CVE-2026-64653

CVE-2026-64653

Medium

Open

TLP:CLEAR

GitHub CLI: Unescaped variable components in request URLs could allow path traversal

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

Details

CVSS Score: 5.1
EPSS Score ⓘ: 0.50%

40.7th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.