CVE-2026-45803
Description
A flaw was found in GitHub CLI. A remote attacker who can influence GitHub Actions workflow log output could inject terminal escape sequences into workflow logs. When a user views these logs using gh run view --log or gh run view --log-failed, the injected sequences may be replayed by the user's terminal. Depending on the terminal emulator in use, this could result in manipulation of displayed content, changes to the terminal window title, or other unintended terminal behavior.
Statement
Red Hat Product Security rates this issue as having a Low security impact.
This issue results from insufficient sanitization of terminal control sequences in GitHub Actions workflow logs displayed by GitHub CLI. An attacker with the ability to influence workflow log output may inject terminal escape sequences that are replayed when a user views logs using the affected commands. Exploitation requires user interaction and primarily affects the integrity of information presented within the terminal session. The impact is limited to terminal display manipulation and does not directly result in disclosure of sensitive information or denial of service.
This vulnerability affects Github CLI versions greater than v1.6.0.
Components included with Red Hat Openshift GitOps and Red Hat OpenStack Platform 18.0 are not affected due to the absence of vulnerable Github CLI code as they use the Github CLI v1.2.1 in their containers or operators which are lower than than the affected one.
Mitigation
As a workaround, log output can be sanitized before display, for example:
gh run view --log | cat -v
Users should exercise caution when viewing logs generated from untrusted workflow runs.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Execute Unauthorized Code or Commands; Hide Activities; Unexpected State
ANSI escape codes can be used for low-severity attacks such as changing the color of console output, but they can also be used to arbitrarily move the cursor, clear the screen, and make fake prompts inside the interactive CLI via malicious user input. In some contexts - depending on the functionality of the terminal in use - ANSI escape codes can be used to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
