CVE-2026-64653

UNKNOWN 0.0

GitHub CLI: Unescaped variable components in request URLs could allow path traversal

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

CWE	CWE-22
Vendor	cli
Product	cli
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for cli cli

Be the first to know when new unknown vulnerabilities affecting cli cli are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

cli / cli

< 2.97.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3 github.com: https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06 github.com: https://github.com/cli/cli/releases/tag/v2.97.0