CVE-2026-45803: GitHub CLI Terminal Escape Sequence Injection Vulnerability
Summary
CVE-2026-45803: GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli. Affects github.com/cli/cli versions >= 1.6.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-45803 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI is a command-line tool that allows users to interact with GitHub from their terminal. It provides functionalities such as managing repositories, pull requests, and issues directly from the command line. The tool is widely used by developers for its efficiency and integration with GitHub's features. However, a vulnerability has been identified in the way GitHub Actions log output is handled in the gh run view command, which can lead to terminal escape sequence injection.
Vulnerability Detail
The vulnerability arises from the handling of log output in the GitHub CLI when executing the gh run view command. This flaw allows an attacker to inject terminal escape sequences, potentially leading to unauthorized command execution or manipulation of the terminal interface. The issue was introduced in version 1.6.0 of the GitHub CLI and affects both the main and v2 versions of the package. If exploited, this vulnerability could compromise the security of the user's terminal session and expose sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the gh run view command until they have updated to the patched version. Additionally, users should be cautious about executing commands that may include untrusted log output.
Conclusion
The CVE-2026-45803 vulnerability in GitHub CLI poses a significant risk due to its potential for terminal escape sequence injection. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for github.com/cli/cli →
FAQ
CVE-2026-45803 is a vulnerability in the GitHub CLI that allows terminal escape sequence injection through GitHub Actions log output.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Terminal escape sequences are special character sequences that control formatting, color, and other output options in terminal emulators.
If you cannot update the package immediately, avoid using the gh run view command and be cautious with untrusted log outputs.
More information can be found in the official Go vulnerability database at https://pkg.go.dev/vuln/GO-2026-5335.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli.
