Medium severityNVD Advisory· Published Aug 6, 2026· Updated Sep 10, 2026
CVE-2026-64653
CVE-2026-64653
Description
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cli/cli/v2Go | < 2.97.0 | 2.97.0 |
Affected products
4- osv-coords2 versions
< 2.98.0-bp160.1.1+ 1 more
- (no CPE)range: < 2.98.0-bp160.1.1
- (no CPE)range: < 2.97.0-1.1
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.