Is CVE-2026-45803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45803 being exploited in the wild.

How severe is CVE-2026-45803?

Low severity, with a CVSS score of 3.5, published 15 May 2026.

Which products and versions are affected?

GitHub Cli/Cli >= 1.6.0, = 1.6.0, <= 1.14.0, SEMVER:introduced=1.6.0, SEMVER:introduced=1.6.0,last_affected=1.14.0; github.com/cli/cli/v2 (Go) < 2.92.0, SEMVER:introduced=0,fixed=2.92.0.

Is there a fix for CVE-2026-45803?

Yes. github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45803 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45803?

Check whether you run GitHub Cli/Cli, github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45803: GitHub CLI terminal escape sequence injection in gh run view

Q: Is there a fix for CVE-2026-45803?

Yes. github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45803 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45803?

Check whether you run GitHub Cli/Cli, github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45803 · Severity: low · CVSS 3.5 · Published 2026-05-15

GitHub CLI is a command-line tool used by developers to interact with GitHub services. A vulnerability in how it displays GitHub Actions logs allows an attacker to inject malicious terminal escape sequences into a user's terminal. If a user views logs from a malicious workflow, an attacker could potentially manipulate the user's terminal display or, in some configurations, execute unauthorized commands on the user's machine.

Technologies: github.com/cli/cli (Go), github.com/cli/cli/v2 (Go). Vendors: GitHub, Go.

Quick answers

Is CVE-2026-45803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45803 being exploited in the wild.
How severe is CVE-2026-45803?: Low severity, with a CVSS score of 3.5, published 15 May 2026.
Which products and versions are affected?: GitHub Cli/Cli >= 1.6.0, < 2.92.0; github.com/cli/cli (Go) >= 1.6.0, <= 1.14.0, SEMVER:introduced=1.6.0, SEMVER:introduced=1.6.0,last_affected=1.14.0; github.com/cli/cli/v2 (Go) < 2.92.0, SEMVER:introduced=0,fixed=2.92.0.
Is there a fix for CVE-2026-45803?: Yes. github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45803 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45803?: Check whether you run GitHub Cli/Cli, github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later
```
go get github.com/cli/cli/v2@v2.92.0
```

Technical details

GitHub CLI (gh) fails to sanitize terminal control sequences in Actions log output when using the `gh run view --log` or `gh run view --log-failed` commands. An attacker who can influence log content (e.g., via a Pull Request that triggers a workflow) can embed ANSI escape sequences. When a user views these logs, the raw escape bytes are passed directly to the terminal emulator. Depending on the terminal's capabilities, this can result in UI spoofing, window title changes, or arbitrary command execution (notably in the `screen` terminal emulator). This issue is fixed in version 2.92.0 by stripping control sequences before output.

Affected products

GitHub cli/cli >= 1.6.0, < 2.92.0

Identifiers

CVE-2026-45803
GHSA-crc3-h8v6-qh57
GO-2026-5335

Timeline

2026-05-13: disclosed
2026-05-15: advisory: NVD publication date
2026-05-19: patched: GitHub Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.