GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agen
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on so
Affected packages
- gh
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://www.cve.org/CVERecord?id=CVE-2026-64654
- https://github.com/cli/cli/commit/2a1409fe88d416cc85fc96fb5bc473f83ed5a054
- https://github.com/cli/cli/releases/tag/v2.97.0
- https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46
Structured record: https://ubuntu.com/security/CVE-2026-64654
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta