Command Line Tool Vulnerability in GitHub CLI Affects Attestation Verification
CVE-2026-64655

2.1LOW

Key Information:

Vendor

Cli

Status
Cli
Vendor
CVE Published:
6 August 2026

What is CVE-2026-64655?

A flaw in GitHub CLI prior to version 2.97.0 allows improper handling of user-defined repository or workflow names in attestation verification. The tool constructs certificate Subject Alternative Name matchers from the --signer-repo and --signer-workflow flag values without properly escaping regex metacharacters. As a result, an attacker can create a deceptive lookalike repository name that might be interpreted as a legitimate signer, thereby bypassing the intended verification checks. This vulnerability poses a significant risk to supply chain integrity, particularly affecting CI/CD pipelines that heavily rely on verified signing workflows. Users are encouraged to upgrade to version 2.97.0 to mitigate this risk.

Affected Version(s)

cli < 2.97.0

References

https://github.com/cli/cli/security/advisories/GHSA-mm27-...
x_refsource_CONFIRM
https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7...
x_refsource_MISC
https://github.com/cli/cli/releases/tag/v2.97.0
x_refsource_MISC

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.