Go/github.com/cli/cli/v2 CVE-2026-64652: low 3.3

GitHub CLI partially discloses authentication tokens in `gh auth status` output

Action: Upgrade github.com/cli/cli/v2 to 2.97.0 or later.

go get github.com/cli/cli/v2@v2.97.0

Affected

Fixed versions

Sources

• osv: GHSA-cg6r-mpgc-h9mm
• https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm
• https://nvd.nist.gov/vuln/detail/CVE-2026-64652
• https://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3
• https://github.com/cli/cli
• https://github.com/cli/cli/releases/tag/v2.97.0

CVE-2026-64652 · published 2026-10-15T18:05:19Z · modified 2026-10-19T21:41:21.449388177Z · JSON