CVE-2026-45803 Details
Description
`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.
A vulnerability in GitHub CLI versions 1.6.0 prior to 2.92.0 allows for terminal escape sequence injection. This occurs when users view GitHub Actions workflow logs with the 'gh run view --log' or 'gh run view --log-failed' commands. The issue arises because GitHub CLI does not sanitize terminal control sequences in raw Actions log output before streaming it to stdout or the configured pager. As a result, an attacker who can manipulate the log content, such as through a pull request-triggered workflow, could embed escape sequences that are executed in the user's terminal. Depending on the terminal emulator, these sequences could alter the window title, disrupt on-screen content, or potentially execute commands in certain emulators like 'screen'.
Users can upgrade GitHub CLI to version 2.92.0 or later. As a temporary workaround on older versions, log output can be piped through a sanitizer, such as 'gh run view --log | cat -v'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github cli | >= 1.6.0, < 2.92.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |