Back to the CVE list

CVE-2026-64654

GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

CVSS score

5.3

EPSS probability

%0.8

Risk score

0.0

Published

2 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.8

CVE-2025-48938Vulnerability in Cli Go Gh

Vendorcli Productgo-gh

Patch verifiedEPSS %11 y ago

5.1

CVE-2026-64653GitHub CLI: Unescaped variable components in request URLs could allow path traversal

Vendorcli Productcli+2 etkilenen

Patch verifiedEPSS %12 mo ago

2.1

CVE-2026-64655GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

Vendorcli Productcli+2 etkilenen

Patch verifiedEPSS %02 mo ago

2.1

CVE-2026-72924GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

Vendorcli Productcli

Patch verifiedEPSS %01 mo ago

3.3

CVE-2026-64652GitHub CLI: Partial token disclosure in `gh auth status` output

Vendorcli Productcli+2 etkilenen

Patch verifiedEPSS %02 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-64654"