SUSE CVE-2026-64655

GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

GO-2024-3310 vulnerabilities

Vulnerabilities for packages: gh...

GHSA-MXCG-P696-RM94

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

...

GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

...

GitHub CLI: Partial token disclosure in `gh auth status` output

...

GitHub CLI: Unescaped variable components in request URLs could allow path traversal

...

CVE-2026-64654

A flaw was found in GitHub CLI gh. Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

Linux Distros Unpatched Vulnerability : CVE-2026-64655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the...

Linux Distros Unpatched Vulnerability : CVE-2026-64654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull reques...

Linux Distros Unpatched Vulnerability : CVE-2026-64653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding,...

Linux Distros Unpatched Vulnerability : CVE-2026-64652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain...

AZL-95472 CVE-2026-64655 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

DEBIAN-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

AZL-95462 CVE-2026-64654 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-64653

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

CVE-2026-64654

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

AZL-95465 CVE-2026-64653 affecting package gh for versions less than 2.97.0-1

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...