RHEL 9 : xterm (RHSA-2026:92418)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92418 advisory. The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that...

Moderate: Red Hat Security Advisory: xterm security update

An update for xterm is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

xterm: code execution via OSC 50 input sequences

A flaw was found in xterm. This issue may allow code execution via font ops...

EEF-CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output

Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the...

[SECURITY] Fedora 45 Update: osc-source_validator-0.43-2.fc45

This is a source service for openSUSE Build Service. This service runs all checks as required by openSUSE:Factory project. This ca n be used to guarantee that all checks succeed also on the service side. This plugin ca n be used via project wide defined services...

Rocky Linux 9 [CIQ] Security Update: xterm / xterm-debuginfo / xterm-debugsource / xterm-resize / etc (crlsa-2025_7427)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257427 advisory. xterm: code execution via OSC 50 input sequences CVE-2022-45063 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100867

Versions of spaceship-prompt up to and including 4.22.5 are vulnerable to Terminal Escape Sequence Injection . The software fails to sanitize control characters within project manifest version fields before rendering them in the zsh prompt . An attacker can embed ANSI/OSC escape sequences in thes...

CVE-2026-100867 spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

EUVD-2026-87939

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

CVE-2026-100867 spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

EUVD-2026-87938

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100866

Versions of onefetch through 2.28.1 are vulnerable to terminal escape sequence injection . The root cause is that the application writes repository information field values to the terminal without removing control characters. Attackers can embed ANSI/OSC escape sequences in project manifest versi...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

SUSE CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431

A flaw was found in kitty. This vulnerability allows a program outputting to the terminal to cause a Denial of Service DoS by sending a specially crafted Operating System Command OSC escape sequence. Due to missing boundary checks when handling text sizing commands with overly long character...

DEBIAN-CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...