Read the docs
TI-2026-46216 Aliases CVE-2026-64655GHSA-mm27-mwq9-fr5g

GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

Priority LOW 17CWE-185Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 28th percentileScored 2026-11-07
Fix Fixed cli (cli): 2.97.0github.com/cli/cli/v2 (Go): 2.97.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cliclibefore 2.97.02.97.0Patch availableCNA
—github.com/cli/cli/v2 (Go)before 2.97.02.97.0Patch availableGHSA-mm27-mwq9-fr5g
  • cli Vendorcli Affected before 2.97.0 Fixed in 2.97.0 Patch available CNA
  • github.com/cli/cli/v2 (Go) Vendor— Affected before 2.97.0 Fixed in 2.97.0 Patch available GHSA-mm27-mwq9-fr5g

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:github:cli:*:*:*:*:*:*:*:*——GitHub
  • cpe:2.3:a:github:cli:*:*:*:*:*:*:*:* Versions — — ·GitHub

Remediation

  • Fix · CNA cli (cli) Fixed in 2.97.0
  • Fix · GHSA-mm27-mwq9-fr5g github.com/cli/cli/v2 (Go) Fixed in 2.97.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-64655
  2. 2026-10-16 Alias added: GHSA-mm27-mwq9-fr5g
  3. 2026-10-16 Fix available: Go/github.com/cli/cli/[email protected] · GHSA-mm27-mwq9-fr5g
  4. 2026-10-16 CVSS score added · GHSA-mm27-mwq9-fr5g
  5. 2026-10-16 Weakness changed · GHSA-mm27-mwq9-fr5g
  6. 2026-10-16 5 new references · GHSA-mm27-mwq9-fr5g

References

Advisory 1

Other 4

  • TI-2025-18873 `gh attestation verify` returns incorrect exit code during verification if no attestations are present CVSS 3.1MEDIUM 6.3
  • TI-2026-33538 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection CVSS 3.1LOW 3.5
  • TI-2024-34983 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer CVSS 3.1CRITICAL 9.6
  • TI-2026-35862 GitHub CLI tokens leak via `gh attestation` commands CVSS 3.1CRITICAL 9.1
  • TI-2024-36052 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace CVSS 3.1HIGH 7.5
  • TI-2024-36051 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences