CVE-2026-64653: GitHub CLI: Unescaped variable components in request URLs could allow path traversal
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
Other sources
GitHub CLI: Unescaped variable components in request URLs could allow path traversal
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.97.0-1 - Upgrade
Upgrade
GitHub CLI (gh)to a version that resolves this vulnerability.Fixed in 2.97.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64653?
The severity of CVE-2026-64653 is rated as risk 33.
How do I fix CVE-2026-64653?
To fix CVE-2026-64653, update the GitHub CLI (gh) to version 2.97.0 or higher.
What is CVE-2026-64653 about?
CVE-2026-64653 involves unescaped variable components in request URLs in GitHub CLI, which can allow path traversal.
Which versions of GitHub CLI are affected by CVE-2026-64653?
Versions of GitHub CLI prior to 2.97.0 are affected by CVE-2026-64653.
What type of vulnerability is CVE-2026-64653 classified as?
CVE-2026-64653 is classified as a Path Traversal vulnerability.