EUVD-2026-54222Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because attacker must pre-register a specific lookalike repo name; UI:R for victim's active invocation; S:C and I:L because integrity impact falls on the downstream pipeline, not the CLI process itself.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as . in organization, repository, and workflow path names and . is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.
AnalysisAI
Sigstore attestation verification in GitHub CLI prior to 2.97.0 can be defeated when an attacker registers a lookalike repository whose name contains dot characters that function as regex wildcards - for example, github/artifact.attestations-workflows matching a matcher intended solely for github/artifact-attestations-workflows. The gh attestation verify command in pkg/cmd/attestation/verify/policy.go constructed Certificate Subject Alternative Name (SAN) matchers by interpolating --signer-repo and --signer-workflow flag values directly into regex patterns without calling regexp.QuoteMeta(), allowing any dot or other metacharacter in a GitHub-permitted name to act as a wildcard. No public exploit has been identified at time of analysis; the CVSS 4.0 AT:P designator confirms exploitation requires the attacker to first position a valid lookalike repository with legitimate Sigstore attestations, making this a targeted rather than opportunistic threat.
Technical ContextAI
The root cause is CWE-185 (Incorrect Regular Expression): user-controlled strings were concatenated directly into Go regex patterns without sanitization. Specifically, expandToGitHubURL() used fmt.Sprintf("(?i)^%s/", url) and validateSignerWorkflow() used fmt.Sprintf("^https://%s", signerWorkflow), both of which treat the input as a regex literal when it is actually arbitrary user-supplied text. GitHub permits dots in organization names, repository names, and workflow path components, and a dot in a Go regex matches any character. The fix (commit 55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55) wraps all URL components in regexp.QuoteMeta() before pattern construction, converting dots and other metacharacters to their escaped equivalents. The affected component is the Sigstore-based supply chain verification flow in the official GitHub CLI (cli/cli), versions prior to 2.97.0 per EUVD-2026-54222.
RemediationAI
Upgrade GitHub CLI to version 2.97.0 or later, which is the vendor-confirmed patched release available at https://github.com/cli/cli/releases/tag/v2.97.0. The fix is a one-line change per affected code path: wrapping the URL string in regexp.QuoteMeta() before regex pattern construction, ensuring dots and other metacharacters are treated as literals. No documented workaround exists short of upgrading; however, organizations relying on gh attestation verify as a CI/CD trust gate should audit their --signer-repo and --signer-workflow values to determine whether any registered lookalike repository names exist on GitHub that could satisfy the pre-fix unescaped pattern, and treat any verification results from unpatched CLI versions as potentially untrusted until the upgrade is applied.
Same weakness CWE-185 – Incorrect Regular Expression
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today