Is there a patch available for CVE-2026-64654?

Yes, a patch is available for CVE-2026-64654. Update the affected software to the latest version immediately.

GitHub CLI CVE-2026-64654

Q: What is the CVSS score of CVE-2026-64654?

CVE-2026-64654 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-54218 MEDIUM

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-08-06 security-advisories@github.com

Information Disclosure

5.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network-delivered attacker content, no privileges needed, user must run a gh command (UI:R), scope changes to the terminal (S:C), low integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.7 MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 23:22 vuln.today

Analysis Generated

Aug 06, 2026 - 23:22 vuln.today

Patch available

Aug 06, 2026 - 23:03 EUVD

CVE Published

Aug 06, 2026 - 22:18 cve.org

MEDIUM 5.3

DescriptionCVE.org

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803-which addressed only gh run view --log-to the other affected command paths. This issue is fixed in version 2.97.0.

AnalysisAI

Terminal escape sequence injection in GitHub CLI (gh) prior to version 2.97.0 allows an attacker who controls content on GitHub - gists, pull requests, releases, codespaces, API responses, skills, or agent-task output - to embed ANSI/VT escape sequences that are rendered verbatim by the victim's terminal when they run any of the affected display commands. Impact ranges from cosmetic screen manipulation (title bar spoofing, on-screen content overwrite) to, on certain terminal emulators that interpret shell-integration or hyperlink escape sequences, arbitrary command execution in the user's shell. This issue broadens the same CWE-150 class addressed by CVE-2026-45803, which patched only the gh run view --log path, to the full set of content-displaying subcommands. No public exploit or KEV listing is present at time of analysis, though the injection surface is wide and the fix is confirmed in v2.97.0.

Technical ContextAI

GitHub CLI is an open-source Go application (github.com/cli/cli) that wraps the GitHub REST and GraphQL APIs, presenting repository, PR, gist, release, codespace, and AI agent-task data in the user's terminal. The vulnerability is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences): the CLI wrote externally-controlled API/content bytes directly to os.Stdout or the internal iostreams.IOStreams.Out writer without stripping or encoding ANSI escape sequences. Because terminal emulators interpret the ESC (0x1B) control character as the start of a command sequence, attacker-supplied bytes can instruct the terminal to rewrite displayed lines, change window titles, manipulate the clipboard (on some emulators), or invoke shell-integration features that cause the terminal to execute commands. The fix, visible in commit 2a1409fe, introduces a CodeQL custom query (unsanitized-response-to-terminal.ql) and a sanitization layer (asciisanitizer / iostreams.Untrusted.String) that strips escape sequences from untrusted content before output. The affected content paths were gist display, API response output, PR display, release listing, codespace metadata, skill output, and agent-task output. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) reflects that exploitation is network-delivered with no attack requirements beyond passive user interaction (running a normal gh command).

RemediationAI

Upgrade GitHub CLI to version 2.97.0 or later, which is confirmed as the vendor-released patch (see https://github.com/cli/cli/releases/tag/v2.97.0 and commit 2a1409fe88d416cc85fc96fb5bc473f83ed5a054). Users can update via their package manager (e.g., brew upgrade gh on macOS, winget upgrade GitHub.cli on Windows, or following the Linux installation instructions at cli.github.com). If immediate upgrade is not possible, the primary compensating control is to avoid running affected display commands - gh gist view, gh api, gh pr view, gh release view, gh codespace, gh skill, agent-task commands - against repositories or gists whose content is not fully trusted. Piping gh output through cat -v or strings will render escape bytes visible rather than interpreted, eliminating the injection risk at the cost of display formatting. Switching to a terminal emulator that does not support shell-integration or OSC sequences (e.g., a plain xterm without advanced features) reduces the worst-case outcome from command execution to cosmetic manipulation, but does not eliminate the vulnerability. No configuration setting within gh itself disables the affected output paths prior to the fix.