GitHub CLI (gh) Command Injection Vulnerability - CVE-2026-64654
Summary
DEBIAN-CVE-2026-64654: GitHub CLI (gh) is GitHub's official command line tool. Affects gh versions 2.23.0+dfsg1-1 – 2.46.0-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI (gh) is the official command line tool for interacting with GitHub, allowing users to manage repositories, pull requests, issues, and more directly from the terminal. It is widely used by developers for its efficiency and integration with GitHub's features. However, prior to version 2.97.0, it was found to have a vulnerability that allowed external content to be printed without proper sanitization, potentially leading to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-64654 affects multiple commands in GitHub CLI (gh) prior to version 2.97.0. It allows an attacker to embed terminal escape sequences in externally controlled content such as gists, API responses, or pull requests. When a user runs an affected command, these escape sequences can manipulate the terminal display or, in some cases, execute arbitrary commands. This vulnerability extends the issues previously addressed in CVE-2026-45803, which was limited to the 'gh run view --log' command.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid executing commands that involve external content until they have updated to the patched version. Additionally, users should be cautious about the content they interact with in GitHub CLI to mitigate potential risks.
Conclusion
In summary, CVE-2026-64654 is a significant vulnerability in GitHub CLI that can lead to serious security risks if not addressed. Users are strongly encouraged to update to version 2.97.0 or later to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for vulnerabilities in your software.
See every vulnerability recorded for gh →
FAQ
CVE-2026-64654 is a vulnerability in GitHub CLI that allows external content to be printed with unneutralized terminal escape sequences, potentially leading to command execution.
You can check your version of GitHub CLI by running 'gh --version' in your terminal. If it is below 2.97.0, it is affected by this vulnerability.
If you cannot update immediately, avoid using commands that involve external content and be cautious about the sources of that content.
More information can be found in the official CVE database or on GitHub's security advisories page.
Vulert monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time alerts without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gh.
