GitHub CLI allows users to verify attestations using the --signer-repo and --signer-workflow flags, but prior to version 2.97.0 the tool builds a certificate Subject Alternative Name matcher without escaping regex metacharacters. This means that characters such as a period are treated as regex wildcards. An attacker can register a look‑alike repository or workflow name that satisfies the matcher intended for a trusted signer, thereby bypassing the intended sigstore attestation verification. The vulnerability falls under CWE‑185 and results in unauthorized trust relationships, potentially compromising supply‑chain validation for CI/CD pipelines and policy gates that pin trust to a specific signing workflow.

All installations of GitHub CLI (gh) older than version 2.97.0 on any operating system are affected. The vulnerability exists when the attestation verify command is run with the --signer-repo or --signer-workflow option and the supplied values contain regex metacharacters.

The CVSS score of 2.1 classifies this as low severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to create a plausible look‑alike repository or workflow with a name that contains regex metacharacters such as a period. Once that name is registered, the attacker can produce valid attestations that will be accepted by a pipeline trusting the original signer. This would allow circumvention of supply‑chain controls, but the attack is limited to environments where the attacker has the ability to create new GitHub repositories or workflows that match the desired pattern.