CVE-2026-45803: GitHub CLI Terminal Escape Sequence Injection Vulnerability
Summary
CVE-2026-45803: GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection. Affects github.com/cli/cli/v2 versions < 2.92.0. Fixed in 2.92.0. How to fix ↓
Also tracked for
- github.com/cli/cli · Go
The same CVE-2026-45803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI is a command-line tool that allows users to interact with GitHub repositories and workflows directly from their terminal. It provides functionalities such as managing pull requests, issues, and GitHub Actions. However, a vulnerability has been identified in its handling of GitHub Actions log output, which can lead to potential security risks when viewing logs.
Vulnerability Detail
A security vulnerability exists in GitHub CLI that allows for terminal escape sequence injection when users view GitHub Actions workflow logs using the commands 'gh run view --log' or 'gh run view --log-failed'. This issue arises from the lack of sanitization of terminal control sequences in the raw Actions log output. An attacker can manipulate the log content, potentially embedding escape sequences that may alter the terminal's behavior or even execute arbitrary commands in certain terminal emulators. The impact varies based on the terminal emulator used by the victim.
How To Fix
Latest published version: v2.103.0 as of 23 Oct 2026
go get github.com/cli/cli/v2@v2.103.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.92.0
This is the first release that contains the fix.
go get github.com/cli/cli/v2@v2.92.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround for users on versions prior to 2.92.0, you can pipe the log output through a sanitizer. For example, use the following command: 'gh run view --log | cat -v'. This will help prevent the execution of any embedded escape sequences.
Conclusion
The CVE-2026-45803 vulnerability in GitHub CLI poses a risk of terminal escape sequence injection through unfiltered log output. Users are advised to upgrade to version 2.92.0 or later to mitigate this risk. For those unable to upgrade immediately, a workaround is available to sanitize log output.
See every vulnerability recorded for github.com/cli/cli/v2 →
FAQ
CVE-2026-45803 is a vulnerability in GitHub CLI that allows terminal escape sequence injection through unfiltered GitHub Actions log output.
Versions of GitHub CLI prior to 2.92.0 are affected by this vulnerability. You can check your version by running 'gh --version' in your terminal.
Terminal escape sequences are special character sequences that control formatting, color, and other output options in terminal emulators.
If an immediate upgrade is not possible, use the workaround by piping log output through a sanitizer, such as 'gh run view --log | cat -v'.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Gopkg.lock file, allowing users to check if their applications are affected without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli/v2.
