Description
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.
Published: 2026-08-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GitHub CLI (gh) printed content from external sources such as gists, pull requests, releases, codespaces, skills, or agent‑tasks without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that the terminal interprets, causing cosmetic changes or, on some terminals, execution of arbitrary commands. The flaw is a classic terminal escape sequence injection, classified as CWE‑150 and CWE‑78. The CVSS score of 5.3 indicates moderate severity.

Affected Systems

All installations of GitHub CLI older than version 2.97.0 on any supported operating system are vulnerable. The issue is fixed in release 2.97.0 and later.

Risk and Exploitability

The vulnerability requires the attacker to control content that the CLI fetches or that a user supplies. Exploitation occurs locally when a user runs an affected gh command; the terminal interprets injected escape sequences. The EPSS score of <1% (approximately 0.00736) indicates a low likelihood of exploitation, but the potential for command execution and the lack of a KEV listing suggest a non‑negligible risk for users who run gh commands in scripts or unattended sessions.

Generated by OpenCVE AI on August 11, 2026 at 02:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GitHub CLI to version 2.97.0 or later.
  • If an upgrade is not immediately possible, configure your terminal to ignore or escape terminal control sequences, or use a terminal emulator that blocks them.
  • Avoid running gh commands that display external content unattended; manually escape or sanitize any externally fetched data before display.

Generated by OpenCVE AI on August 11, 2026 at 02:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 07 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Cli
Cli cli
Vendors & Products Cli
Cli cli

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.
Title GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
Weaknesses CWE-150
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Cli Cli
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T17:09:40.307Z

Reserved: 2026-07-20T17:11:30.896Z

Link: CVE-2026-64654

cve-icon Vulnrichment

Updated: 2026-08-07T15:29:33.891Z

cve-icon NVD

Status : Received

Published: 2026-08-06T22:18:13.380

Modified: 2026-08-07T18:17:20.587

Link: CVE-2026-64654

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-06T18:27:38Z

Links: CVE-2026-64654 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T02:45:06Z

Weaknesses
  • CWE-150

    Improper Neutralization of Escape, Meta, or Control Sequences

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')