EUVD-2026-87938

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-73506

A flaw was found in Oh My Posh, a customizable terminal prompt renderer. The software failed to properly sanitize attacker-controlled data, such as current directory names and Git metadata, before displaying it in the terminal. This oversight allows for terminal escape sequence injection, enablin...

CVE-2026-73479

CVE-2026-73479 affects dua-cli. When printing marked file paths after exiting the TUI, it fails to filter OSC/CSI terminal escape sequences, allowing crafted file names to cause escape-sequence interpretation by the terminal emulator. Potential impacts include title spoofing and clipboard manipul...

CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036: Improper Neutralization of Escape, Meta, or Control Sequences

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73035: Improper Neutralization of Escape, Meta, or Control Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-45803: Improper Neutralization of Escape, Meta, or Control Sequences

gh is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. The vulnerabilit...