CVE-2026-64654
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- EPSS probability
- 0.75%
- CWE
- CWE-150
- Published
- 2026-08-06
- Last modified
- 2026-08-07
Affected products
- cli cli
Weakness type
Related vulnerabilities
- CVE-2026-82710 — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
- CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-19591 — OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS...
- CVE-2026-72847 — broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
- CVE-2026-75483 — powerlevel10k Control Character Injection via package.json Version
- CVE-2026-73506 — Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
- CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD
- CVE-2026-73036 — Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml