All vulnerabilities
CVE-2026-64653GHSA-4fjg-2h4q-fwg3GO-2026-6765

github.com/cli/cli/v2: GitHub CLI allows path traversal through unescaped request URL components

cli github.com/cli/cli/v2goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.51%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.97.0Fixed versionGitHub
Published6 Aug 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2.97.0github.com/cli/cli/v2, goGitHubgo get github.com/cli/cli/v2@v2.97.0
  • 2.97.0github.com/cli/cli/v2, GoOSVgo get github.com/cli/cli/v2@v2.97.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to address a different resource than intended.

Details

Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.

In 2.97.0, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.

Impact

An attacker who can control a value that flows into a request path can cause gh to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.

Remediation and Mitigation

  1. Upgrade gh to 2.97.0.
  2. Be cautious when running gh against untrusted repositories or inputs whose names you do not control.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/cli/cli/v2, go< 2.97.0GitHub
  • cliaffected: < 2.97.0CVE List
  • github.com/cli/cli/v2, Gofrom first release, fixed in 2.97.0OSV

References 5