CVE-2026-64655

Go/github.com/cli/cli CVE-2026-64655: low 2.1

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6767
• nvd: CVE-2026-64655
• https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g
• https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55
• https://github.com/cli/cli/releases/tag/v2.97.0

CVE-2026-64655 · published 2026-10-19T21:08:35Z · modified 2026-10-19T21:31:49.979387869Z · JSON

Go/github.com/cli/cli/v2 CVE-2026-64655: low 2.1

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

Action: Upgrade github.com/cli/cli/v2 to 2.97.0 or later.

go get github.com/cli/cli/v2@v2.97.0

Affected

Fixed versions

Sources

• osv: GHSA-mm27-mwq9-fr5g
• nvd: CVE-2026-64655
• https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g
• https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55
• https://github.com/cli/cli
• https://github.com/cli/cli/releases/tag/v2.97.0

CVE-2026-64655 · published 2026-10-15T18:08:20Z · modified 2026-10-19T21:41:04.715150068Z · JSON