ZeroDay Findings
Sign inSign up

Findings

CVE-2026-64653

GitHub CLI allows path traversal through unescaped request URL components

Published Oct 15, 2026 · updated Oct 15, 2026

### Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause to address a different resource than intended. ### Details Not all request URLs in the codebase were built with proper escaping of their variable path components. When a component is interpolated into the path without percent encoding, and that component contains URL path metacharacters, it breaks out of its intended segment and changes the effective request path. In , request URLs are constructed in a safe manner, so a variable component can no longer escape its intended segment. ### Impact An attacker who can control a value that flows into a request path can cause to send the request to a different API endpoint than intended. This can lead the CLI to read or act on a resource other than the one the user meant to target. ### Remediation and Mitigation 1. Upgrade to . 2. Be cautious when running against untrusted repositories or inputs whose names you do not control.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ### Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause to address a different resource than intended. ### Details Not all request URLs in the codebase were built wit

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/cli/cli/v2 fixed in 2.97.0

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/cli/cli/v2 fixed in 2.97.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary A path traversal vulnerability has been identified in the GitHub CLI where some HTTP request URLs, REST API calls in particular, were built without properly escaping their variable path components. A value containing URL path metacharacters can alter the request path and cause to address a different resource than intended. ### Details Not all request URLs in the codebase were built wit

Affected

  • Go github.com/cli/cli/v20 → 2.97.0
  • go github.com/cli/cli/v2< 2.97.0

Sources

  • CVE.orgVulnerability recordCVE-2026-64653

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-4fjg-2h4q-fwg3

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OSV.devPackage advisoryGHSA-4fjg-2h4q-fwg3

    GitHub CLI allows path traversal through unescaped request URL components

    osv.dev

References