{"id":"GO-2026-6767","revision":"1d7712998bea4349bc0e2cb1e19bc56c","records":[{"revision":"1d7712998bea4349bc0e2cb1e19bc56c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6767","aliases":["CVE-2026-64655","GHSA-mm27-mwq9-fr5g"],"title":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli","description":"GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli","state":0,"publishedAt":"2026-10-19T21:08:35+00:00","modifiedAt":"2026-10-19T21:31:49.9793879+00:00","affected":[{"ecosystem":"Go","name":"github.com/cli/cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cli/cli/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.97.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g","https://nvd.nist.gov/vuln/detail/CVE-2026-64655","https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55","https://github.com/cli/cli/releases/tag/v2.97.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6767","license":"OSV · upstream source license applies","key":"osv:GO-2026-6767","identifiers":["GO-2026-6767","CVE-2026-64655","GHSA-mm27-mwq9-fr5g"]},"retained":false,"historicalAffected":[]}],"coverage":[]}