HTTP Request Vulnerability in GitHub CLI Tool Affects User Intent
CVE-2026-64653

5.1MEDIUM

Key Information:

Vendor

Cli

Status
Cli
Vendor
CVE Published:
6 August 2026

What is CVE-2026-64653?

GitHub CLI, the official command line interface tool for managing GitHub repositories, contains a vulnerability that allows for unsafe handling of HTTP request URLs. Before version 2.97.0, the tool failed to properly percent encode variable path components. This omission could permit attackers to manipulate repository or resource values, potentially redirecting API requests to unintended endpoints, thus compromising user expectations and actions.

Affected Version(s)

cli < 2.97.0

References

https://github.com/cli/cli/security/advisories/GHSA-4fjg-...
x_refsource_CONFIRM
https://github.com/cli/cli/commit/0c2eea6338a2323cfff0001...
x_refsource_MISC
https://github.com/cli/cli/releases/tag/v2.97.0
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.