Vulnerability Bulletins |
CVE-2026-64653 |
|
| Affected software | GITHUB |
| GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-64653 | |