PT-2026-41313 · Github · Gh

Williammartin · Published 2026-05-15 · Updated 2026-06-25 · CVE-2026-45803

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions gh versions 1.6.0 through 2.91.x

Description GitHub CLI allows terminal escape sequence injection when users view GitHub Actions workflow logs. The issue occurs because the 'gh run view --log' and 'gh run view --log-failed' commands stream workflow log lines to stdout or a configured pager without sanitizing terminal control sequences. An attacker capable of influencing log content, such as through a pull request triggered workflow, can embed escape sequences. Depending on the terminal emulator used by the victim, these sequences could change the window title, manipulate on-screen content, or potentially execute arbitrary commands in certain emulators like screen.

Recommendations Update to version 2.92.0.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-45803

GHSA-CRC3-H8V6-QH57

GO-2026-5335

Affected Products

Gh

References · 15

• 🔥 https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45803.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45803 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45803 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45803 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crc3-h8v6-qh57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45803 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-45803 · Security Note
• https://osv.dev/vulnerability/GO-2026-5335 · Vendor Advisory
• https://github.com/cli/cli · Note
• https://t.me/cveNotify/164478 · Telegram Post
• https://t.me/cveNotify/163911 · Telegram Post
• https://t.me/CVEtracker/53937 · Telegram Post