GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:21663-1

Vulnerability from csaf_opensuse - Published: 2026-08-26 16:15 - Updated: 2026-09-16 21:47
Summary
Security update for gh
Severity
Important
Notes
Title of the patch: Security update for gh
Description of the patch: This update for gh fixes the following issues: Changes in gh: - Update to version 2.98.0: * chore: fix extra whitespace * Default Codespaces port forwarding to loopback * Bump gh-aw-actions to v0.87.1 and recompile workflows * Fix issue triage action compatibility * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 * chore: bump go to 1.26.7 (#14205) * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 * Revert "ci: add temporary step to verify Linux repo signing keys" * ci: add temporary step to verify Linux repo signing keys * Accept pre-release tags in deployment validation (#14193) * chore: sign APT repositories with both keys * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 * chore(deps): bump the aw-actions group with 2 updates * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 * Bump Go to 1.26.6 * Upgrade gh-aw workflows to v0.85.4 * chore(deps): bump github.com/google/go-containerregistry * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 * Address review: drop cleanup markers, document search-type in skill * Reconcile feature detection cleanup comment rules in AGENTS.md * Update AGENTS.md with cleanup comment guidance * Address review feedback * Add --search-type flag for semantic and hybrid issue search * Rename config mock constructors to match repo convention * Document when to use the config mock or the isolated config * Accept config content in NewIsolatedTestConfig * Clear auth environment variables in isolated test config * Isolate git config in tests that shell out to git * Rename config stub file to test.go * chore(deps): bump the aw-actions group with 2 updates * Add aw-actions group to dependabot configuration * Rename cli-code-reviewer skill to code-review (#14116) * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 * Reduce item-add test diff * Isolate item-add test mocks * Test item-add output through command path * Run lint workflow when the lint workflow changes * Bump golangci-lint in CI to v2.12.2 * Clarify PR testing section expectations * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * chore(deps): bump azure/login from 3.0.0 to 3.0.1 * chore(deps): bump actions/attest from 4.2.1 to 4.2.2 * Use reflect.Pointer instead of deprecated reflect.Ptr * Add a scheduled tech debt burndown skill (#14095) * Restore automatic spam issue closure (#14088) * Give Dependabot triage a real reachability check (#14087) * Route release deletions through api.Client (#14077) * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 * chore(deps): bump github.com/google/go-containerregistry * Grant the gate the scopes its CI read needs * Keep pre-flight dedup out of the integrity proxy * Key direct/indirect off the // indirect comment * Gate triager confidence on required evidence * Gate Dependabot triage on deterministic pre-flight check * Set GH_EXTENSION=1 when gh invokes an extension * Tell agents to use the PR template in AGENTS.md * Merge pull request #14062 from cli/williammartin-wp-08-release-create * Route extension requests through api.Client (#14059) * Route autolink requests through api.Client (#14013) * chore(deps): bump the codeql-actions group across 1 directory with 3 updates * fix(release create): trim spaces when parsing X-Oauth-Scopes * Match worktree rev-parse stub against absolute path on Windows * fix(pr/checkout): pass -- before worktree path so dash paths work * docs(pr/checkout): add worktree usage example to help text * docs(skills): mention pr checkout worktree support * chore(pr checkout): polish worktree related tests * Route gpg key requests through api.Client (#13997) * Use generated key in ssh-key acceptance test * Route ssh key requests through api.Client * Fix item-add output for non-TTY * test(pr/checkout): add acceptance tests for worktree checkout * chore(deps): bump actions/attest from 4.2.0 to 4.2.1 * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 * Generate unique acceptance SSH keys * Route deploy key requests through api.Client * Collapse spam triage into the agentic issue-triage workflow (#14027) * Run Dependabot triage hourly * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 * Require explicit PR review ownership (#14028) * Slim down dependabot triage comments (#14019) * Wrap RESTWithNext errors as api.HTTPError * Bail out early on unusable --worktree paths * Clarify current-worktree rejection message * Return ok bool from revParseFacts to satisfy nilerr * Drop docs on self-explanatory worktree helpers * Trim redundant comments and clarify worktree field names * Resolve worktree target once instead of re-querying git * Fix worktree toplevel stub to match Windows absolute paths * Detect worktrees via git rev-parse and reject the current worktree * Address review: restore TODO, flatten detachCmds, guard worktree symlink * Cover detach-reuse, worktree fetch dir, and symlink path resolution * Harden worktree submodule prefixing and cover cmd.Dir stripping * Create branch when reusing a worktree with a new --branch name * Extract authenticatedCommand helper to dedupe -C handling * Preserve no-force safety when reusing a worktree for fork PRs * Simplify submodule worktree prefix to inline conditional * Run submodule commands inside the worktree for pr checkout * tidying.. * Refine PR checkout worktree flag help * Add --worktree flag to gh pr checkout - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266618). - Update to version 2.97.0, fixing four security issues (CVE-2026-64654, bsc#1276662, CVE-2026-64653, bsc#1276664, CVE-2026-64652, bsc#1276663, CVE-2026-64655, bsc#1276661): * CVE-2026-64654: terminal escape sequence injection in gist view, api, pr diff, release download --output -, codespace logs, skills preview and agent-task view/create * CVE-2026-64653: unescaped variable path components in request URLs could redirect gh to a different resource than intended * CVE-2026-64652: gh auth status could print part of the auth token in plaintext for token types with an underscore after the prefix * CVE-2026-64655: gh attestation verify built its --signer-repo/ --signer-workflow matcher without escaping regex metacharacters, allowing a lookalike signer to pass verification * Add named field columns to gh project item-list and item-edit
Patchnames: openSUSE-Leap-16.0-packagehub-536
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-39821
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-64652
Affected products
Recommended 7 products, the same list as for CVE-2026-39821
Threats
Impact low
CVE-2026-64653
Affected products
Recommended 7 products, the same list as for CVE-2026-39821
Threats
Impact moderate
CVE-2026-64654
Affected products
Recommended 7 products, the same list as for CVE-2026-39821
Threats
Impact moderate
CVE-2026-64655
Affected products
Recommended 7 products, the same list as for CVE-2026-39821
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for gh",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for gh fixes the following issues:\n\nChanges in gh:\n\n- Update to version 2.98.0:\n  * chore: fix extra whitespace\n  * Default Codespaces port forwarding to loopback\n  * Bump gh-aw-actions to v0.87.1 and recompile workflows\n  * Fix issue triage action compatibility\n  * chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0\n  * chore: bump go to 1.26.7 (#14205)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1\n  * Revert \"ci: add temporary step to verify Linux repo signing keys\"\n  * ci: add temporary step to verify Linux repo signing keys\n  * Accept pre-release tags in deployment validation (#14193)\n  * chore: sign APT repositories with both keys\n  * chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6\n  * chore(deps): bump the aw-actions group with 2 updates\n  * chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2\n  * Bump Go to 1.26.6\n  * Upgrade gh-aw workflows to v0.85.4\n  * chore(deps): bump github.com/google/go-containerregistry\n  * chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12\n  * Address review: drop cleanup markers, document search-type in skill\n  * Reconcile feature detection cleanup comment rules in AGENTS.md\n  * Update AGENTS.md with cleanup comment guidance\n  * Address review feedback\n  * Add --search-type flag for semantic and hybrid issue search\n  * Rename config mock constructors to match repo convention\n  * Document when to use the config mock or the isolated config\n  * Accept config content in NewIsolatedTestConfig\n  * Clear auth environment variables in isolated test config\n  * Isolate git config in tests that shell out to git\n  * Rename config stub file to test.go\n  * chore(deps): bump the aw-actions group with 2 updates\n  * Add aw-actions group to dependabot configuration\n  * Rename cli-code-reviewer skill to code-review (#14116)\n  * chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4\n  * Reduce item-add test diff\n  * Isolate item-add test mocks\n  * Test item-add output through command path\n  * Run lint workflow when the lint workflow changes\n  * Bump golangci-lint in CI to v2.12.2\n  * Clarify PR testing section expectations\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * chore(deps): bump azure/login from 3.0.0 to 3.0.1\n  * chore(deps): bump actions/attest from 4.2.1 to 4.2.2\n  * Use reflect.Pointer instead of deprecated reflect.Ptr\n  * Add a scheduled tech debt burndown skill (#14095)\n  * Restore automatic spam issue closure (#14088)\n  * Give Dependabot triage a real reachability check (#14087)\n  * Route release deletions through api.Client (#14077)\n  * chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0\n  * chore(deps): bump github.com/google/go-containerregistry\n  * Grant the gate the scopes its CI read needs\n  * Keep pre-flight dedup out of the integrity proxy\n  * Key direct/indirect off the // indirect comment\n  * Gate triager confidence on required evidence\n  * Gate Dependabot triage on deterministic pre-flight check\n  * Set GH_EXTENSION=1 when gh invokes an extension\n  * Tell agents to use the PR template in AGENTS.md\n  * Merge pull request #14062 from cli/williammartin-wp-08-release-create\n  * Route extension requests through api.Client (#14059)\n  * Route autolink requests through api.Client (#14013)\n  * chore(deps): bump the codeql-actions group across 1 directory with 3 updates\n  * fix(release create): trim spaces when parsing X-Oauth-Scopes\n  * Match worktree rev-parse stub against absolute path on Windows\n  * fix(pr/checkout): pass -- before worktree path so dash paths work\n  * docs(pr/checkout): add worktree usage example to help text\n  * docs(skills): mention pr checkout worktree support\n  * chore(pr checkout): polish worktree related tests\n  * Route gpg key requests through api.Client (#13997)\n  * Use generated key in ssh-key acceptance test\n  * Route ssh key requests through api.Client\n  * Fix item-add output for non-TTY\n  * test(pr/checkout): add acceptance tests for worktree checkout\n  * chore(deps): bump actions/attest from 4.2.0 to 4.2.1\n  * chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0\n  * Generate unique acceptance SSH keys\n  * Route deploy key requests through api.Client\n  * Collapse spam triage into the agentic issue-triage workflow (#14027)\n  * Run Dependabot triage hourly\n  * chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5\n  * Require explicit PR review ownership (#14028)\n  * Slim down dependabot triage comments (#14019)\n  * Wrap RESTWithNext errors as api.HTTPError\n  * Bail out early on unusable --worktree paths\n  * Clarify current-worktree rejection message\n  * Return ok bool from revParseFacts to satisfy nilerr\n  * Drop docs on self-explanatory worktree helpers\n  * Trim redundant comments and clarify worktree field names\n  * Resolve worktree target once instead of re-querying git\n  * Fix worktree toplevel stub to match Windows absolute paths\n  * Detect worktrees via git rev-parse and reject the current worktree\n  * Address review: restore TODO, flatten detachCmds, guard worktree symlink\n  * Cover detach-reuse, worktree fetch dir, and symlink path resolution\n  * Harden worktree submodule prefixing and cover cmd.Dir stripping\n  * Create branch when reusing a worktree with a new --branch name\n  * Extract authenticatedCommand helper to dedupe -C handling\n  * Preserve no-force safety when reusing a worktree for fork PRs\n  * Simplify submodule worktree prefix to inline conditional\n  * Run submodule commands inside the worktree for pr checkout\n  * tidying..\n  * Refine PR checkout worktree flag help\n  * Add --worktree flag to gh pr checkout\n\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only\n  Punycode-encoded labels allows for validation bypass and privilege\n  escalation (bsc#1266618).\n\n- Update to version 2.97.0, fixing four security issues (CVE-2026-64654, bsc#1276662,\n  CVE-2026-64653, bsc#1276664, CVE-2026-64652, bsc#1276663, CVE-2026-64655, bsc#1276661):\n  * CVE-2026-64654: terminal escape sequence injection in gist view, api,\n    pr diff, release download --output -, codespace logs, skills preview\n    and agent-task view/create\n  * CVE-2026-64653: unescaped variable path components in request URLs\n    could redirect gh to a different resource than intended\n  * CVE-2026-64652: gh auth status could print part of the auth token in\n    plaintext for token types with an underscore after the prefix\n  * CVE-2026-64655: gh attestation verify built its --signer-repo/\n    --signer-workflow matcher without escaping regex metacharacters,\n    allowing a lookalike signer to pass verification\n  * Add named field columns to gh project item-list and item-edit\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-536",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21663-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266618",
        "url": "https://bugzilla.suse.com/1266618"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276661",
        "url": "https://bugzilla.suse.com/1276661"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276662",
        "url": "https://bugzilla.suse.com/1276662"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276663",
        "url": "https://bugzilla.suse.com/1276663"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276664",
        "url": "https://bugzilla.suse.com/1276664"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64652 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64652/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64653 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64653/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64654 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64654/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-64655 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-64655/"
      }
    ],
    "title": "Security update for gh",
    "tracking": {
      "current_release_date": "2026-09-16T21:47:07Z",
      "generator": {
        "date": "2026-08-26T16:15:07Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21663-1",
      "initial_release_date": "2026-08-26T16:15:07Z",
      "revision_history": [
        {
          "date": "2026-08-26T16:15:07Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:46:06Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:47:07Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gh-2.98.0-bp160.1.1.aarch64",
                "product": {
                  "name": "gh-2.98.0-bp160.1.1.aarch64",
                  "product_id": "gh-2.98.0-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh@2.98.0-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gh-bash-completion-2.98.0-bp160.1.1.noarch",
                "product": {
                  "name": "gh-bash-completion-2.98.0-bp160.1.1.noarch",
                  "product_id": "gh-bash-completion-2.98.0-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh-bash-completion@2.98.0-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gh-fish-completion-2.98.0-bp160.1.1.noarch",
                "product": {
                  "name": "gh-fish-completion-2.98.0-bp160.1.1.noarch",
                  "product_id": "gh-fish-completion-2.98.0-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh-fish-completion@2.98.0-bp160.1.1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gh-zsh-completion-2.98.0-bp160.1.1.noarch",
                "product": {
                  "name": "gh-zsh-completion-2.98.0-bp160.1.1.noarch",
                  "product_id": "gh-zsh-completion-2.98.0-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh-zsh-completion@2.98.0-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gh-2.98.0-bp160.1.1.ppc64le",
                "product": {
                  "name": "gh-2.98.0-bp160.1.1.ppc64le",
                  "product_id": "gh-2.98.0-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh@2.98.0-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gh-2.98.0-bp160.1.1.s390x",
                "product": {
                  "name": "gh-2.98.0-bp160.1.1.s390x",
                  "product_id": "gh-2.98.0-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh@2.98.0-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gh-2.98.0-bp160.1.1.x86_64",
                "product": {
                  "name": "gh-2.98.0-bp160.1.1.x86_64",
                  "product_id": "gh-2.98.0-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gh@2.98.0-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-2.98.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64"
        },
        "product_reference": "gh-2.98.0-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-2.98.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le"
        },
        "product_reference": "gh-2.98.0-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-2.98.0-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x"
        },
        "product_reference": "gh-2.98.0-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-2.98.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64"
        },
        "product_reference": "gh-2.98.0-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-bash-completion-2.98.0-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch"
        },
        "product_reference": "gh-bash-completion-2.98.0-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-fish-completion-2.98.0-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch"
        },
        "product_reference": "gh-fish-completion-2.98.0-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gh-zsh-completion-2.98.0-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        },
        "product_reference": "gh-zsh-completion-2.98.0-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-26T16:15:07Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-64652",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64652"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_\u003cAPPID\u003e_\u003cJWT\u003e), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64652",
          "url": "https://www.suse.com/security/cve/CVE-2026-64652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276663 for CVE-2026-64652",
          "url": "https://bugzilla.suse.com/1276663"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-26T16:15:07Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-64652"
    },
    {
      "cve": "CVE-2026-64653",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64653"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64653",
          "url": "https://www.suse.com/security/cve/CVE-2026-64653"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276664 for CVE-2026-64653",
          "url": "https://bugzilla.suse.com/1276664"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-26T16:15:07Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-64653"
    },
    {
      "cve": "CVE-2026-64654",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64654"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that content can embed escape sequences that are interpreted by the terminal of a user who runs an affected command, with impact ranging from cosmetic manipulation of the title or on-screen content to, on some terminal emulators, command execution. This extends the same class of issue as CVE-2026-45803-which addressed only gh run view --log-to the other affected command paths. This issue is fixed in version 2.97.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64654",
          "url": "https://www.suse.com/security/cve/CVE-2026-64654"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276662 for CVE-2026-64654",
          "url": "https://bugzilla.suse.com/1276662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-26T16:15:07Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-64654"
    },
    {
      "cve": "CVE-2026-64655",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-64655"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to 2.97.0, gh attestation verify   builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow   flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as   `.`   in organization, repository, and workflow path names and   `.`   is a regex wildcard, an attacker can register a lookalike name (for example  github/artifact.attestations-workflows) that satisfies a matcher intended for a different trusted signer (github/artifact-attestations-workflows), bypassing the intended Sigstore attestation verification. Exploitation requires the attacker to create a plausible lookalike repository and produce valid attestations from it, which could undermine supply chain verification for CI/CD pipelines or policy gates that pin trust to a specific signing workflow. This issue is fixed in version 2.97.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
          "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-64655",
          "url": "https://www.suse.com/security/cve/CVE-2026-64655"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276661 for CVE-2026-64655",
          "url": "https://bugzilla.suse.com/1276661"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:gh-2.98.0-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:gh-bash-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-fish-completion-2.98.0-bp160.1.1.noarch",
            "openSUSE Leap 16.0:gh-zsh-completion-2.98.0-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-26T16:15:07Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-64655"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.