Skip to content
OpenAdvisories
Low · 3.5 CVE-2026-45803 EUVD-2026-30549GHSA-crc3-h8v6-qh57GO-2026-5335

gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

Published May 15, 2026 · Updated May 15, 2026 · Assigned by GitHub_M

Description

`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.

Affected products

VendorProductAffectedFixed
cli cli >= 1.6.0, < 2.92.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 gh No fix yet —
Debian 12 gh No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gh No fix yet —
Ubuntu 25.10 gh No fix yet —
Ubuntu 22.04 LTS gh No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS gh No fix yet —
Ubuntu Pro 24.04 LTS gh No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gh 2.62.0-18 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cli/cli >= 1.6.0, <= 1.14.0 — GHSA-crc3-h8v6-qh57
Go github.com/cli/cli >= 1.6.0 — GO-2026-5335
Go github.com/cli/cli/v2 < 2.92.0 2.92.0 GHSA-crc3-h8v6-qh57

Advisories 1

References