The vulnerability in GitHub CLI allows a malicious actor to inject terminal escape sequences into workflow logs that are displayed when a user runs `gh run view`, `gh run view --log`, or `gh run view --log-failed`. These unescaped control sequences can alter the terminal window title, overwrite on‑screen content, or in certain terminal emulators such as "screen" potentially trigger arbitrary command execution. Because the vulnerability exists only in the client‑side display of logs, the attacker must have the ability to influence the log content, typically via a workflow triggered by a pull request authored by the attacker. The CVSS score of 3.5 indicates a low severity, reflecting that the risk depends on both the attacker’s ability to inject log data and the victim’s local terminal environment. Nonetheless, the potential for command execution in vulnerable terminals warrants careful consideration.

The affected product is GitHub CLI (cli:cli). Versions from 1.6.0 up to, but not including, 2.92.0 are vulnerable. The issue was fixed in release 2.92.0, which sanitizes log output before it is streamed to the terminal or pager.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to supply a malicious workflow that writes controlled log lines; they then have to run a vulnerable `gh run view` command locally to trigger the injection. While the risk of remote exploitation is low, the use of certain terminal emulators could allow local command execution, making the vulnerability non‑trivial for users who view logs in those environments.