CVE catalog
CVE-2026-64654
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent
- Severity
- Medium · CVSS 6.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.77% · Oct 25, 2026
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | gh | sid | 2.46.0-4 | vulnerable |
| Debian | gh | trixie | 2.46.0-3 | vulnerable |
| Debian | gh | bookworm | 2.23.0+dfsg1-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | gh | source | sid | (unfixed) | not yet assigned | Not reported | [1144403] |
| Debian | gh | source | trixie | (unfixed) | not yet assigned | Not reported | [1144403] |
| Debian | gh | source | bookworm | (unfixed) | not yet assigned | Not reported | [1144403] |
Notes
[trixie] gh: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [gh]Affected
Details (2)
2.23.0+dfsg1-1· amd64 · bookwormAffected
nvd · gh · debian · bookworm; nvd · gh · debian · 12
2.23.0+dfsg1-1· arm64 · bookwormAffected
nvd · gh · debian · bookworm; nvd · gh · debian · 12
[Debian 13 (Trixie)]
- [gh]Affected
Details (2)
2.46.0-3· amd64 · trixieAffected
nvd · gh · debian · 13
2.46.0-3· arm64 · trixieAffected
nvd · gh · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11530-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-64654]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-64654]
- [https://security-tracker.debian.org/tracker/CVE-2026-64654]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64654.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]