CVE-2026-64654

Name of the Vulnerable Software and Affected Versions GitHub CLI versions prior to 2.97.0

Description Multiple commands in the GitHub CLI print content from gists, APIs, pull requests, releases, codespaces, skills, or agent-tasks without neutralizing terminal escape sequences. Terminal escape sequences are special character strings that can control terminal formatting or behavior. An attacker capable of influencing this content can embed sequences that the user's terminal interprets, potentially leading to cosmetic changes in the title or on-screen content, or command execution on certain terminal emulators.

Recommendations Update to version 2.97.0.