Skip to content
OpenAdvisories

Package · Go

github.com/cli/cli

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-64655

    GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

    GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-…

    cli cli gh github.com/cli/cli Debian Ubuntu Go
  • Low 3.3
    CVE-2026-64652

    GitHub CLI: Partial token disclosure in `gh auth status` output

    GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token c…

    cli cli gh github.com/cli/cli Debian Ubuntu Go
  • Low 3.5
    CVE-2026-45803

    gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

    `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh…

    cli cli gh github.com/cli/cli Debian Ubuntu Go