{"id":"EUVD-2026-54213","enisaUuid":"421a69bd-3643-31bf-bdef-7aa4740d78d8","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","datePublished":"Aug 6, 2026, 5:51:54 PM","dateUpdated":"Aug 7, 2026, 2:54:13 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3\nhttps://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","aliases":"CVE-2026-64653\nGHSA-4fjg-2h4q-fwg3\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"6b79bec6-7f1a-3d70-a844-31faf35856af","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 2.97.0"}],"enisaIdVendor":[{"id":"afdc3d39-8302-3d72-9e31-10bad077b8c4","vendor":{"name":"cli"}}],"enisaIdVulnerability":[{"id":"e0fcb32b-7b40-3c7b-a37e-f4681ce87126","vulnerability":{"id":"GHSA-4fjg-2h4q-fwg3","description":"GitHub CLI allows path traversal through unescaped request URL components","datePublished":"Oct 15, 2026, 6:07:14 PM","dateUpdated":"Oct 15, 2026, 6:07:15 PM","baseScore":0.0,"references":"https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64653\nhttps://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06\nhttps://github.com/cli/cli\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","enisa_id":"EUVD-2026-54213\n","aliases":"GHSA-4fjg-2h4q-fwg3\nCVE-2026-64653\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e28cb863-d7be-3257-8f21-012c6f43b144","vulnerability":{"id":"CVE-2026-64653","description":"GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.","datePublished":"Aug 6, 2026, 5:51:54 PM","dateUpdated":"Aug 7, 2026, 2:54:13 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3\nhttps://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","enisa_id":"EUVD-2026-54213\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 1, 2026, 7:16:18 AM","vulnerabilityProduct":[{"id":"613ff42a-6f04-3910-a9a2-ba7f71918b2c","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 2.97.0"}],"vulnerabilityVendor":[{"id":"6e5e8cfa-1b6a-3f75-8746-e28180a75d5a","vendor":{"name":"cli"}}]}}],"enisaIdAdvisory":[{"id":"386e318b-1e40-305d-ab0c-e2224bcf2c3a","advisory":{"id":"openSUSE-SU-2026:21663-1","description":"Security update for gh","summary":"Security update for gh","datePublished":"Aug 26, 2026, 4:15:07 PM","dateUpdated":"Sep 17, 2026, 5:42:37 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21663-1.json\nhttps://bugzilla.suse.com/1266618\nhttps://bugzilla.suse.com/1276661\nhttps://bugzilla.suse.com/1276662\nhttps://bugzilla.suse.com/1276663\nhttps://bugzilla.suse.com/1276664\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-64652/\nhttps://www.suse.com/security/cve/CVE-2026-64653/\nhttps://www.suse.com/security/cve/CVE-2026-64654/\nhttps://www.suse.com/security/cve/CVE-2026-64655/\n","aliases":"CVE-2026-39821\nCVE-2026-64652\nCVE-2026-64653\nCVE-2026-64654\nCVE-2026-64655\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0a3324d2-cd24-33d3-9513-5c6b2a307054","product":{"name":"gh-bash-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"1dee3c84-204f-3d47-9452-8c09f515f66a","product":{"name":"gh-fish-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"27da8119-d16a-3860-bbc3-1fe563ca7f48","product":{"name":"gh-0:2.98.0-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3f7332f1-f44a-3596-bd5e-75cac50510d6","product":{"name":"gh-0:2.98.0-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"726f83ed-682b-35ed-90d5-a145dda9e535","product":{"name":"gh-zsh-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"802a8b47-750a-3e55-a3f5-b562f22ce757","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"d35cb0a2-935b-33b2-8085-cea381699246","product":{"name":"gh-0:2.98.0-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fd3bef13-01da-3dcc-9a1c-1194658d0526","product":{"name":"gh-0:2.98.0-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"64da63cc-655c-316c-a3f0-44849e9a43b5","advisory":{"id":"msrc_CVE-2026-64653","description":"GitHub CLI: Unescaped variable components in request URLs could allow path traversal","datePublished":"Aug 11, 2026, 1:02:35 AM","dateUpdated":"Aug 23, 2026, 2:50:21 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64653.json\n","aliases":"CVE-2026-64653\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"1906c325-8c53-301f-856e-b26a95fbd389","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"69bf0c0c-343e-3738-aa7c-de99f751c55b","product":{"name":"gh","vendor":{"name":"r-lib"}}},{"id":"780ac912-00e0-391c-9dfa-77e9e7f47b60","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"f4504116-eef7-3827-851a-b7450aaa7c3a","product":{"name":"azl3 gh 0:2.62.0-20.azl3","vendor":{"name":"Microsoft"}}}]}},{"id":"cde3ea0b-7e14-30a1-bebc-d5f2033c8307","advisory":{"id":"openSUSE-SU-2026:11530-1","description":"gh-2.97.0-1.1 on GA media","summary":"gh-2.97.0-1.1 on GA media","datePublished":"Aug 17, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:19:55 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11530-1.json\nhttps://www.suse.com/security/cve/CVE-2026-64652/\nhttps://www.suse.com/security/cve/CVE-2026-64653/\nhttps://www.suse.com/security/cve/CVE-2026-64654/\nhttps://www.suse.com/security/cve/CVE-2026-64655/\n","aliases":"CVE-2026-64652\nCVE-2026-64653\nCVE-2026-64654\nCVE-2026-64655\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05081f45-6c93-3175-b06d-c0fd84ab2303","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"11ad0a39-ef69-3433-815c-841d589375e2","product":{"name":"gh-fish-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"257cce34-e582-3ce6-9b79-3dc2d99690c7","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"2601d2a6-804f-3a93-ad29-5129458f0932","product":{"name":"gh-fish-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2fe30d22-756e-30e7-866b-580542648347","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"4548076c-5f54-35bf-bf6d-f5057b8f29c0","product":{"name":"gh-bash-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"59c96c25-3324-30b7-8cbf-2419a2f53a2b","product":{"name":"gh-bash-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6c45aaea-b025-337d-9dd7-63622d539cdf","product":{"name":"gh-fish-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6dda8d88-67d9-3063-be1c-a37f0abbbdde","product":{"name":"gh-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"713eac1d-ba87-3fa6-a393-60f10bd4fd44","product":{"name":"gh-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"74253eff-db36-3fad-a1b6-eab2ec5c53fc","product":{"name":"gh-fish-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"854261ae-c52b-3b68-924a-e642a3d77bce","product":{"name":"gh-bash-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"adbd65af-980f-354e-887b-762b9f923e94","product":{"name":"gh-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b5aabe9e-bc63-3b20-aad2-7a71e44501f8","product":{"name":"gh-bash-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c35dd7cd-804a-32cb-bc26-5c3bcc7a80ae","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d58410a8-b2f3-36e4-bf33-fe2cc866f8f0","product":{"name":"gh-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fee80ac9-97ec-357d-93e1-af2c18c0cf25","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}