Bug 2512206 (CVE-2026-64654)
| Summary: | CVE-2026-64654 github.com/cli/cli: GitHub CLI: Terminal escape sequence injection allows command execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anjoseph, eglynn, jjoyce, jprabhak, jpretori, jschluet, lhh, mburns, mgarciac, wtam |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in GitHub CLI (gh). Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's terminal, potentially leading to cosmetic manipulation of the display or, in some terminal emulators, arbitrary command execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-06 22:22:05 UTC
|