12392 matches found
AZL-87048 CVE-2026-45803 affecting package gh for versions less than 2.62.0-18
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
CVE-2026-45803
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
UBUNTU-CVE-2026-45803
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
CVE-2026-45803 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
CVE-2026-45803 gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
CVE-2026-45803
GitHub CLI (gh) vulnerability: from v1.6.0 to before v2.92.0, terminal escape sequences could be injected via workflow logs when using gh run view --log or --log-failed, due to unsanitized raw log output. An attacker controlling Actions logs (e.g., PR-triggered workflows) could cause terminal man...
flux2-cli-2.8.7-1.1 on GA media (moderate)
flux2-cli-2.8.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10769-1 Rating: moderate Cross-References: CVE-2026-45022 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
CVE-2026-45773: Cross-Site Request Forgery (CSRF)
Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a...
PT-2026-41313
Name of the Vulnerable Software and Affected Versions gh versions 1.6.0 through 2.91.x Description GitHub CLI allows terminal escape sequence injection when users view GitHub Actions workflow logs. The issue occurs because the 'gh run view --log' and 'gh run view --log-failed' commands stream...
CVE-2026-45539: Improper Link Resolution Before File Access
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob / Path.rglob calls and read each match with Path.readtext, transparently following symbolic links. A symlink...
CVE-2026-45803: Improper Neutralization of Escape, Meta, or Control Sequences
gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...
tekton-cli-0.45.0-1.1 on GA media (moderate)
tekton-cli-0.45.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10776-1 Rating: moderate Cross-References: CVE-2026-25679 CVSS scores: CVE-2026-25679 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2026-25679 SUSE : 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA...
CVE-2026-45370
python-utcp is the python implementation of UTCP. Prior to 1.1.3, prepareenvironment in clicommunicationprotocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This...
GHSA-5V57-8RXJ-3P2R python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
Summary prepareenvironment in clicommunicationprotocol.py passes a full copy of os.environ to every CLI subprocess. When combined with the Command Injection vulnerability CWE-78 in substituteutcpargs tracked as GHSA-33p6-5jxp-p3x4, an attacker can exfiltrate all process-level secrets in a single...
Command Injection
Overview utcp-cli is an UTCP communication protocol plugin for wrapping local command-line tools. Affected versions of this package are vulnerable to Command Injection via the substituteutcpargs function. An attacker can execute arbitrary shell commands by supplying crafted input to the toolargs...
@ekairos/cli (>=1.22.35, <=1.22.100-beta.development.0), @ekairos/context (1.22.102-beta.feature-lab-task-sandbox-beta.0) +31 more potentially affected by CVE-2026-42570 via devalue (5.6.3)
devalue NPM version 5.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - @ekairos/cli =1.22.35, =1.21.52-beta.0, =1.22.9-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0,...
CVE-2026-45369
Summary: CVE-2026-45369 affects python-utcp prior to 1.1.3, where _substitute_utcp_args in cli_communication_protocol.py injects user-controlled tool_args directly into shell commands without sanitization, leading to potential Remote Code Execution when commands are run via /bin/bash -c (Unix) or...
CVE-2026-45369 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the substituteutcpargs method in clicommunicationprotocol.py inserts user-controlled toolargs values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c Unix o...
CVE-2026-45370 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
python-utcp is the python implementation of UTCP. Prior to 1.1.3, prepareenvironment in clicommunicationprotocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This...
