GHSA-4fjg-2h4q-fwg3

Source

https://github.com/advisories/GHSA-4fjg-2h4q-fwg3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4fjg-2h4q-fwg3/GHSA-4fjg-2h4q-fwg3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4fjg-2h4q-fwg3

Aliases

CVE-2026-64653

Published

2026-10-15T18:07:14Z

Modified

2026-10-15T18:15:03Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

GitHub CLI allows path traversal through unescaped request URL components

Details

Summary

A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause gh to address a different resource than intended.

Details

Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path.

In 2.97.0, request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment.

Impact

An attacker who can control a value that flows into a request path can cause gh to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target.

Remediation and Mitigation

Upgrade gh to 2.97.0.
Be cautious when running gh against untrusted repositories or inputs whose names you do not control.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-15T18:07:14Z",
    "nvd_published_at":  "2026-08-06T22:18:13Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/cli/cli/v2

Package

Name: github.com/cli/cli/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/cli/cli/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.97.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4fjg-2h4q-fwg3/GHSA-4fjg-2h4q-fwg3.json"