Medium
gh — security advisory
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
- Products
- gh
- Affected versions
- 2.27.0+dfsg1-1build1, 2.30.0-2, 2.35.0-1, 2.4.0+dfsg1-1, 2.4.0+dfsg1-2, 2.40.1+dfsg1-1, 2.42.1-1, 2.43.1-1, 2.44.1-1, 2.44.1-2, 2.45.0-1, 2.45.0-1build1, 2.45.0-1ubuntu0.1, 2.45.0-1ubuntu0.2, 2.45.0-1ubuntu0.2+esm1, 2.45.0-1ubuntu0.2+esm2, 2.45.0-1ubuntu0.3, 2.45.0-1ubuntu0.3+esm1, 2.45.0-1ubuntu0.3+esm2, 2.45.0-1ubuntu0.3+esm3, 2.46.0-3, 2.46.0-4, 2.46.0-4ubuntu0.26.04.1~esm1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-64653
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:49 UTC · Revision 1
Source evidence
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.
osv:UBUNTU-CVE-2026-64653
gh
Fixed versions: Not specified
gh
Fixed versions: Not specified
gh
Fixed versions: Not specified
gh
Fixed versions: Not specified
Complete source record
{
"id": "fe1a012e5d34d61996723c4096d3f0b9b99eedabac0099527b29f3cf627ae53b",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-64653",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-64653",
"summary": "GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.",
"evidence": "osv:UBUNTU-CVE-2026-64653",
"products": [
{
"name": {
"value": "gh",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.0+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.0+dfsg1-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gh",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.27.0+dfsg1-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "2.30.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.35.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.40.1+dfsg1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.42.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.43.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.44.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.44.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1build1",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.2+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.2+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.3",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.3+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.3+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "2.45.0-1ubuntu0.3+esm3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "gh",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.46.0-4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "gh",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.46.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "2.46.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "2.46.0-4ubuntu0.26.04.1~esm1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-64653",
"aliases": [
"UBUNTU-CVE-2026-64653"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gh",
"purl": "pkg:deb/ubuntu/gh?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.4.0+dfsg1-1",
"2.4.0+dfsg1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-64653.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gh",
"binary_version": "2.4.0+dfsg1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gh",
"purl": "pkg:deb/ubuntu/gh?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"2.27.0+dfsg1-1build1",
"2.30.0-2",
"2.35.0-1",
"2.40.1+dfsg1-1",
"2.42.1-1",
"2.43.1-1",
"2.44.1-1",
"2.44.1-2",
"2.45.0-1",
"2.45.0-1build1",
"2.45.0-1ubuntu0.1",
"2.45.0-1ubuntu0.2",
"2.45.0-1ubuntu0.2+esm1",
"2.45.0-1ubuntu0.2+esm2",
"2.45.0-1ubuntu0.3",
"2.45.0-1ubuntu0.3+esm1",
"2.45.0-1ubuntu0.3+esm2",
"2.45.0-1ubuntu0.3+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-64653.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gh",
"binary_version": "2.45.0-1ubuntu0.3+esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gh",
"purl": "pkg:deb/ubuntu/gh?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.46.0-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-64653.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gh",
"binary_version": "2.46.0-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gh",
"purl": "pkg:deb/ubuntu/gh?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"2.46.0-3",
"2.46.0-4",
"2.46.0-4ubuntu0.26.04.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-64653.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gh",
"binary_version": "2.46.0-4ubuntu0.26.04.1~esm1"
}
]
}
}
],
"modified": "2026-10-17T12:59:16.727248329Z",
"provider": "osv",
"upstream": [
"CVE-2026-64653"
],
"references": [
"https://ubuntu.com/security/CVE-2026-64653",
"https://www.cve.org/CVERecord?id=CVE-2026-64653",
"https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06",
"https://github.com/cli/cli/releases/tag/v2.97.0",
"https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3"
]
},
"related_cves": [
{
"value": "CVE-2026-64653",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359582,
"published_at": "2026-08-06T22:18:00+00:00"
}