CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection Log injection by an authenticated user is possible in the Neo4j query.log when Neo4j is not configured to be in json format. Summary Neo4j does not escape control characters in the metadata field when of a bolt transaction. An autenticated user could send...

CVE-2021-42574

Trojan Source:Invisible Vulnerabilities - Code generator — In simple terms, the vulnerability is that the code looks different from what it will be when compiled : The attack consists of using embedded control characters in comments and strings to reorder source code characters in a way that...

unicode-control-characters-action

Unicode Control Characters Action A GitHub Action to find Unicode control characters using the Red Hat diagnostic tool https://access.redhat.com/security/vulnerabilities/RHSB-2021-007 to detect RHSB-2021-007 Trojan source attacks CVE-2021-42574,CVE-2021-42694 Inputs args Required The script...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

EUVD-2026-91648

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104026

In Sapling SCM versions prior to v0.2.20260929-102736 , the software allows control characters to be embedded in Git subtree URLs . An attacker can exploit this by providing a maliciously constructed repository; if a target clones this repository, it can trigger code execution during otherwise re...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs (ALMALINUX9.2:CLSA-2025:1762867600)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762867600 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of...

Rocky Linux 8 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23481)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523481 advisory. openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61984 openssh: OpenSSH: Null character in ssh:// UR...

AlmaLinux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1767955216)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1767955216 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1767954480)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1767954480 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

AlmaLinux 9.2 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1711476502)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1711476502 advisory. - Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 - Sudo before 1.9.13 does not escape control...

CentOS Linux 8.4 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1767627828)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767627828 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...

CVE-2026-100867

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

EUVD-2026-87939

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

CVE-2026-100867

Versions of spaceship-prompt up to and including 4.22.5 are vulnerable to Terminal Escape Sequence Injection . The software fails to sanitize control characters within project manifest version fields before rendering them in the zsh prompt . An attacker can embed ANSI/OSC escape sequences in thes...

SUSE CVE-2026-93566

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...