Improper Validation of Specified Type of Input in GitHub CLI - CVE-2026-64655
Published: July 31, 2026
Vulnerability identifier: #VU140581
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64655
CWE-ID: CWE-1287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
GitHub CLI
GitHub CLI
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass attestation verification.
The vulnerability exists due to improper input neutralization in SAN matching during Sigstore attestation verification when processing `--signer-repo` or `--signer-workflow` flag values. A remote attacker can create a lookalike repository or workflow name with regex metacharacters to bypass attestation verification.
Exploitation requires producing valid Sigstore attestations from the lookalike signer and user interaction to run verification with the affected flags.
How to mitigate CVE-2026-64655
Install security update from vendor's website.