Executive brief
GitHub CLI is a command-line tool used by developers to interact with GitHub services. A vulnerability in how it displays GitHub Actions logs allows an attacker to inject malicious terminal escape sequences into a user's terminal. If a user views logs from a malicious workflow, an attacker could potentially manipulate the user's terminal display or, in some configurations, execute unauthorized commands on the user's machine.
Technical details
GitHub CLI (gh) fails to sanitize terminal control sequences in Actions log output when using the `gh run view --log` or `gh run view --log-failed` commands. An attacker who can influence log content (e.g., via a Pull Request that triggers a workflow) can embed ANSI escape sequences. When a user views these logs, the raw escape bytes are passed directly to the terminal emulator. Depending on the terminal's capabilities, this can result in UI spoofing, window title changes, or arbitrary command execution (notably in the `screen` terminal emulator). This issue is fixed in version 2.92.0 by stripping control sequences before output.
Affected products
- GitHub cli/cli >= 1.6.0, < 2.92.0
Timeline
- 2026-05-13: disclosed
- 2026-05-15: advisory: NVD publication date
- 2026-05-19: patched: GitHub Advisory updated and reviewed