# CVE-2026-45803: GitHub CLI terminal escape sequence injection in gh run view

Source: https://junglewise.ai/threats/cve-2026-45803-github-cli-terminal-escape-sequence-injection-in-gh-run-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-45803 · Severity: low · CVSS 3.5 · Published 2026-05-15

GitHub CLI is a command-line tool used by developers to interact with GitHub services. A vulnerability in how it displays GitHub Actions logs allows an attacker to inject malicious terminal escape sequences into a user's terminal. If a user views logs from a malicious workflow, an attacker could potentially manipulate the user's terminal display or, in some configurations, execute unauthorized commands on the user's machine.

Technologies: [github.com/cli/cli (Go)](https://junglewise.ai/threats/technologies/github-com-cli-cli), [github.com/cli/cli/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-cli-cli-v2). Vendors: [GitHub](https://junglewise.ai/threats/vendors/github), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-45803 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45803 being exploited in the wild.

**How severe is CVE-2026-45803?** Low severity, with a CVSS score of 3.5, published 15 May 2026.

**Which products and versions are affected?** GitHub Cli/Cli >= 1.6.0, < 2.92.0; github.com/cli/cli (Go) >= 1.6.0, <= 1.14.0, SEMVER:introduced=1.6.0, SEMVER:introduced=1.6.0,last_affected=1.14.0; github.com/cli/cli/v2 (Go) < 2.92.0, SEMVER:introduced=0,fixed=2.92.0.

**Is there a fix for CVE-2026-45803?** Yes. github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45803 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45803?** Check whether you run GitHub Cli/Cli, github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cli/cli/v2 (Go): upgrade to 2.92.0 or later

  ```sh
  go get github.com/cli/cli/v2@v2.92.0
  ```


## Technical details

GitHub CLI (gh) fails to sanitize terminal control sequences in Actions log output when using the `gh run view --log` or `gh run view --log-failed` commands. An attacker who can influence log content (e.g., via a Pull Request that triggers a workflow) can embed ANSI escape sequences. When a user views these logs, the raw escape bytes are passed directly to the terminal emulator. Depending on the terminal's capabilities, this can result in UI spoofing, window title changes, or arbitrary command execution (notably in the `screen` terminal emulator). This issue is fixed in version 2.92.0 by stripping control sequences before output.

## Affected products

- GitHub cli/cli >= 1.6.0, < 2.92.0

## Identifiers

- CVE-2026-45803
- GHSA-crc3-h8v6-qh57
- GO-2026-5335

## Timeline

- 2026-05-13: disclosed
- 2026-05-15: advisory: NVD publication date
- 2026-05-19: patched: GitHub Advisory updated and reviewed

## References

- [https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57](https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57)
- [https://api.github.com/repos/cli/cli/security-advisories/GHSA-crc3-h8v6-qh57](https://api.github.com/repos/cli/cli/security-advisories/GHSA-crc3-h8v6-qh57)

## Related threats

- [GitHub CLI attestation verification regex bypass](https://junglewise.ai/threats/cve-2026-64655-github-cli-attestation-verification-regex-bypass)
- [GitHub CLI path traversal via unescaped URL components](https://junglewise.ai/threats/cve-2026-64653-github-cli-path-traversal-via-unescaped-url-components)
- [GitHub CLI token masking bypass in auth status](https://junglewise.ai/threats/cve-2026-64652-github-cli-token-masking-bypass-in-auth-status)
- [GitHub CLI incorrect authorization header in attestation and release commands](https://junglewise.ai/threats/cve-2026-48501-github-cli-incorrect-authorization-header-in-attestation-and)
- [`gh attestation verify` returns incorrect exit code during verification if no attestations are present](https://junglewise.ai/threats/cve-2025-25204-gh-attestation-verify-returns-incorrect-exit-code-during)