Описание
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.
A flaw was found in GitHub CLI. A remote attacker who can influence GitHub Actions workflow log output could inject terminal escape sequences into workflow logs. When a user views these logs using gh run view --log or gh run view --log-failed, the injected sequences may be replayed by the user's terminal. Depending on the terminal emulator in use, this could result in manipulation of displayed content, changes to the terminal window title, or other unintended terminal behavior.
Отчет
Red Hat Product Security rates this issue as having a Low security impact. This issue results from insufficient sanitization of terminal control sequences in GitHub Actions workflow logs displayed by GitHub CLI. An attacker with the ability to influence workflow log output may inject terminal escape sequences that are replayed when a user views logs using the affected commands. Exploitation requires user interaction and primarily affects the integrity of information presented within the terminal session. The impact is limited to terminal display manipulation and does not directly result in disclosure of sensitive information or denial of service.
Меры по смягчению последствий
As a workaround, log output can be sanitized before display, for example:
gh run view --log | cat -v
Users should exercise caution when viewing logs generated from untrusted workflow runs.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel8 | Not affected | ||
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel9 | Not affected | ||
| Red Hat OpenStack Platform 18.0 | rhoso-operators/openstack-operator-bundle | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
3.5 Low
CVSS3
Связанные уязвимости
`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.
`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run. Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands. This vulnerability is fixed in 2.92.0.
gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
`gh` is GitHub\u2019s official command line tool. From 1.6.0 to before ...
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
EPSS
3.5 Low
CVSS3