SB2026073116 - Multiple vulnerabilities in GitHub CLI

Description

This security bulletin contains information about 4 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-64653)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause the cli to read or act on a different resource than intended.

The vulnerability exists due to path traversal in HTTP request URL construction for REST API calls when interpolating unescaped variable path components into request paths. A remote attacker can supply a value containing URL path metacharacters to cause the cli to read or act on a different resource than intended.

User interaction is required because the victim must run the cli against untrusted repositories or other untrusted inputs whose names are attacker-controlled.

2) Improper Neutralization of Escape, Meta, or Control Sequences (CVE-ID: CVE-2026-64654)

CWE-ID: CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to inject terminal escape sequences and potentially execute commands.

The vulnerability exists due to improper neutralization of terminal escape sequences in multiple gh commands when printing externally controlled content to the terminal or configured pager. A remote user can provide crafted content to inject terminal escape sequences and potentially execute commands.

User interaction is required to run an affected command and view the attacker-influenced content. The impact depends on the terminal emulator and may range from screen or title manipulation to command execution on some emulators.

3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-64652)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into sent data in the `gh auth status` output masking logic when reporting authentication state. A local user can run `gh auth status` and capture or share the output to disclose sensitive information.

Only token formats containing an underscore after the prefix are affected, and the issue occurs when the command is run without the `--show-token` flag.

4) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-64655)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass attestation verification.

The vulnerability exists due to improper input neutralization in SAN matching during Sigstore attestation verification when processing `--signer-repo` or `--signer-workflow` flag values. A remote attacker can create a lookalike repository or workflow name with regex metacharacters to bypass attestation verification.

Exploitation requires producing valid Sigstore attestations from the lookalike signer and user interaction to run verification with the affected flags.

Remediation

Install update from vendor's website.

References

• https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3
• https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46
• https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm
• https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g