CVE-2026-45803 | gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

Exp

`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.

Published: 2026-05-15 Last update: 2026-05-21 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-45803 is rated Exploit Available (50/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.04%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2026-45803

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2026-45803

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-16 — 0.04% —

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-45803

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
3.5 3.1 LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
 2.1 1.4 [email protected]

Weakness enumeration for CVE-2026-45803

GitHub Security Advisory for CVE-2026-45803

GHSA-crc3-h8v6-qh57 · Severity: low · Ecosystem: go — GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

OS Trackers for CVE-2026-45803

vendor priority summary link
debian not yet assigned CVE-2026-45803 not yet assigned priority: Debian including 1 source packages (gh), 3 status rows across 3 suites (bookworm, sid, trixie): open 3. https://security-tracker.debian.org/tracker/CVE-2026-45803
suse low — https://www.suse.com/security/cve/CVE-2026-45803/
ubuntu medium CVE-2026-45803 medium priority: Ubuntu including 1 source packages (gh), 5 status rows across 5 suites (jammy, noble, questing, resolute, upstream): needs-triage 5. https://ubuntu.com/security/CVE-2026-45803

Affected software / configurations for CVE-2026-45803

Vendor Product Version Raw CPE
github cli >= 1.6.0, < 2.92.0 cpe:2.3:a:github:cli:*:*:*:*:*:*:*:*

References for CVE-2026-45803

URL Tags
https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57 Exploit Mitigation Vendor Advisory
cvelogic Threat Intelligence