CVE-2026-64655 in CLI
Summary
by MITRE • 08/07/2026
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as `.` in organization, repository, and workflow path names and `.` is a regex wildcard, an attacker can register a lookalike name (for example github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in GitHub CLI (gh) versions prior to 2.97.0 represents a critical security flaw in the attestation verification process that undermines supply chain integrity for continuous integration and deployment pipelines. This issue affects the certificate Subject Alternative Name matcher implementation within the gh attestation verify command, where user-supplied values from --signer-repo and --signer-workflow flags are processed without proper regex metacharacter escaping. The fundamental technical flaw occurs when the tool constructs regular expression patterns from repository and workflow names without sanitizing special characters that have semantic meaning in regex syntax.
The operational impact of this vulnerability stems from the fact that GitHub permits the use of period characters in organization, repository, and workflow path names, while the period character serves as a wildcard metacharacter in regular expressions. This creates a scenario where an attacker can register repositories or workflows with names containing literal periods that match regex patterns intended for legitimate signers. For instance, a malicious actor could create a repository named github/artifact.attestations-workflows which would inadvertently match a verification pattern meant for github/artifact-attestations-workflows due to the period character being interpreted as a wildcard rather than a literal dot.
This vulnerability directly aligns with CWE-184, which addresses incomplete or missing input validation for regular expressions, and maps to ATT&CK technique T1553.006 related to credential access through supply chain compromise. The attack vector requires an attacker to not only register a lookalike repository but also to generate valid Sigstore attestations from that repository, effectively creating a false positive in the verification process. When successful, this bypasses the intended trust model for CI/CD pipelines and policy gates that rely on specific signing workflows to validate artifact integrity.
The security implications extend beyond simple name matching as they fundamentally compromise the trust boundaries established by supply chain verification systems. Organizations that depend on gh attestation verify for pipeline security could be deceived into accepting malicious artifacts from compromised repositories that appear legitimate due to the regex bypass. This undermines the core principle of provenance verification in software supply chains, potentially allowing attackers to inject malicious code or tampered artifacts into production environments while maintaining the appearance of legitimate signing operations.
The fix implemented in version 2.97.0 addresses this issue through proper input sanitization and regex escaping mechanisms that ensure repository and workflow names are treated as literal strings rather than regular expressions during the attestation verification process. This change aligns with industry best practices for secure input handling and prevents attackers from exploiting the regex interpretation of user-supplied data to bypass security controls. Organizations should immediately upgrade to version 2.97.0 or later to remediate this vulnerability and maintain the integrity of their supply chain verification processes, particularly those relying on GitHub CLI for attestation management in automated deployment pipelines.