# CVE-2026-64653: GitHub CLI path traversal via unescaped URL components

Source: https://junglewise.ai/threats/cve-2026-64653-github-cli-path-traversal-via-unescaped-url-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64653 · Severity: medium · CVSS 4 · Published 2026-08-06

GitHub CLI is the official command-line interface for GitHub's platform. Prior to version 2.97.0, the tool could be tricked into accessing unintended API endpoints when repository or resource names contain special URL characters. An attacker could craft malicious repository names to redirect operations to different resources, potentially allowing unauthorized access or data manipulation through a user's authenticated session.

Technologies: [github.com/cli/cli (Go)](https://junglewise.ai/threats/technologies/github-com-cli-cli), [github.com/cli/cli/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-cli-cli-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-64653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64653 being exploited in the wild.

**How severe is CVE-2026-64653?** Medium severity, with a CVSS score of 4, published 6 August 2026.

**Which products and versions are affected?** github.com/cli/cli (Go) SEMVER:introduced=0; github.com/cli/cli/v2 (Go) < 2.97.0, SEMVER:introduced=0,fixed=2.97.0.

**Is there a fix for CVE-2026-64653?** Yes. github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64653 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-64653?** Check whether you run github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later

  ```sh
  go get github.com/cli/cli/v2@v2.97.0
  ```


## Technical details

The vulnerability is a path traversal / URL path injection flaw in GitHub CLI's HTTP request URL construction. Multiple commands interpolated variable path components (repository names, resource IDs, etc.) into REST API URLs without percent-encoding, allowing URL metacharacters to alter the request path and reach unintended API endpoints. The fix, released in version 2.97.0, introduced a SafeURL package that enforces percent-encoding of all variable components and rejects path-traversal patterns like ".." to prevent endpoint confusion attacks. The vulnerability requires user interaction—a user must execute a gh command that references an attacker-controlled repository or resource name.

## Affected products

- GitHub CLI prior to 2.97.0

## Identifiers

- CVE-2026-64653
- GHSA-4fjg-2h4q-fwg3
- GO-2026-6765

## Timeline

- 2026-07-31: patched: Fixed in version 2.97.0

## References

- [https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06](https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06)
- [https://github.com/cli/cli/releases/tag/v2.97.0](https://github.com/cli/cli/releases/tag/v2.97.0)

## Related threats

- [GitHub CLI attestation verification regex bypass](https://junglewise.ai/threats/cve-2026-64655-github-cli-attestation-verification-regex-bypass)
- [GitHub CLI token masking bypass in auth status](https://junglewise.ai/threats/cve-2026-64652-github-cli-token-masking-bypass-in-auth-status)
- [GitHub CLI incorrect authorization header in attestation and release commands](https://junglewise.ai/threats/cve-2026-48501-github-cli-incorrect-authorization-header-in-attestation-and)
- [GitHub CLI terminal escape sequence injection in gh run view](https://junglewise.ai/threats/cve-2026-45803-github-cli-terminal-escape-sequence-injection-in-gh-run-view)
- [`gh attestation verify` returns incorrect exit code during verification if no attestations are present](https://junglewise.ai/threats/cve-2025-25204-gh-attestation-verify-returns-incorrect-exit-code-during)