CVE-2026-45803

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45803", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T08:19:32.604Z", "datePublished": "2026-05-15T15:26:56.675Z", "dateUpdated": "2026-05-15T17:48:01.444Z"}, "containers": {"cna": {"title": "gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"}], "affected": [{"vendor": "cli", "product": "cli", "versions": [{"version": ">= 1.6.0, < 2.92.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T15:26:56.675Z"}, "descriptions": [{"lang": "en", "value": "`gh` is GitHub\u2019s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0."}], "source": {"advisory": "GHSA-crc3-h8v6-qh57", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T17:47:37.269392Z", "id": "CVE-2026-45803", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:48:01.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45803", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:47:37.269392Z"}}}], "references": [{"url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:47:54.476Z"}}], "cna": {"title": "gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection", "source": {"advisory": "GHSA-crc3-h8v6-qh57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "cli", "product": "cli", "versions": [{"status": "affected", "version": ">= 1.6.0, < 2.92.0"}]}], "references": [{"url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57", "name": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "`gh` is GitHub\u2019s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T15:26:56.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45803", "state": "PUBLISHED", "dateUpdated": "2026-05-15T17:48:01.444Z", "dateReserved": "2026-05-13T08:19:32.604Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-15T15:26:56.675Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cli", "vendor": "cli", "versions": [{"status": "affected", "version": ">= 1.6.0, < 2.92.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:cli:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3FFD63D-E38A-4B49-9AC1-1ECE14929DF4", "versionEndExcluding": "2.92.0", "versionStartIncluding": "1.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "`gh` is GitHub\u2019s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0."}, {"lang": "es", "value": "\u2019gh\u2019 es la herramienta oficial de l\u00ednea de comandos de GitHub. Desde la versi\u00f3n 1.6.0 hasta antes de la 2.92.0, se ha identificado una vulnerabilidad de seguridad en GitHub CLI que podr\u00eda permitir la inyecci\u00f3n de secuencias de escape de terminal cuando los usuarios ven los registros de flujo de trabajo de GitHub Actions usando \u2019gh run view --log\u2019 o \u2019gh run view --log-failed\u2019. La vulnerabilidad se origina en la forma en que GitHub CLI maneja la salida de registro sin procesar de Actions. Los comandos \u2019gh run view --log\u2019 y \u2019gh run view --log-failed\u2019 transmiten l\u00edneas de registro de flujo de trabajo a stdout o al paginador configurado sin sanear las secuencias de control de terminal. Un atacante que puede influir en el contenido del registro de GitHub Actions, por ejemplo a trav\u00e9s de un flujo de trabajo activado por una PR, puede incrustar secuencias de escape que se reproducen en la terminal del usuario cuando inspeccionan la ejecuci\u00f3n. Dependiendo del emulador de terminal de la v\u00edctima, las secuencias inyectadas podr\u00edan cambiar el t\u00edtulo de la ventana, manipular el contenido en pantalla, o en algunos emuladores de terminal (como screen) potencialmente ejecutar comandos arbitrarios. Esta vulnerabilidad se corrige en la versi\u00f3n 2.92.0."}], "id": "CVE-2026-45803", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45803", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T17:47:37.269392Z", "version": "2.0.3"}}]}, "published": "2026-05-15T16:16:15.280", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/cli/cli: GitHub CLI: Arbitrary command execution via terminal escape sequence injection in workflow logs", "id": "2477927", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477927"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-150", "details": ["A flaw was found in GitHub CLI. A remote attacker who can influence GitHub Actions workflow log output could inject terminal escape sequences into workflow logs. When a user views these logs using gh run view --log or gh run view --log-failed, the injected sequences may be replayed by the user's terminal. Depending on the terminal emulator in use, this could result in manipulation of displayed content, changes to the terminal window title, or other unintended terminal behavior."], "mitigation": {"lang": "en:us", "value": "As a workaround, log output can be sanitized before display, for example:\n``` gh run view --log | cat -v ```\nUsers should exercise caution when viewing logs generated from untrusted workflow runs."}, "name": "CVE-2026-45803", "package_state": [{"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Not affected", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Not affected", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-05-15T15:26:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-45803\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45803\nhttps://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"], "statement": "Red Hat Product Security rates this issue as having a Low security impact.\nThis issue results from insufficient sanitization of terminal control sequences in GitHub Actions workflow logs displayed by GitHub CLI. An attacker with the ability to influence workflow log output may inject terminal escape sequences that are replayed when a user views logs using the affected commands. Exploitation requires user interaction and primarily affects the integrity of information presented within the terminal session. The impact is limited to terminal display manipulation and does not directly result in disclosure of sensitive information or denial of service.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,2.92.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cli", "source": "cna", "vendor": "cli"}, "product": "cli", "vendor": "cli"}], "created": "2026-05-15T18:00:05.568320+00:00", "updated": "2026-05-17T17:01:38.746280+00:00", "vendors": ["cli", "cli$PRODUCT$cli"]}