CVE-2026-64654

The record

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803—which addressed only gh run view --log—to the other affected command paths. This issue is fixed in version 2.97.0.

Affected packages

Related vulnerabilities

• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
• CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
• CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
• CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
• CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
• CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150
• CVE-2026-49147 App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences… CWE-150
• CVE-2026-11373 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. CWE-150