PT-2026-39678

Name of the Vulnerable Software and Affected Versions GuardDog versions 2.6.0 through 2.9.0 Description GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. This allows a...

Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Description String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the...

CVE-2026-40505

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running...

Linux Distros Unpatched Vulnerability : CVE-2026-40505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadat...

SUSE CVE-2026-25996

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences...

CVE-2026-25996 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences...

CVE-2026-25996 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences...

CVE-2026-25996 Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences...

CVE-2026-25996: Improper Neutralization of Escape, Meta, or Control Sequences

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences...

CLSA-2026-1768410745 aide: Fix of CVE-2025-54389

CVE-2025-54389: escape filenames in error/log messages to prevent terminal escape sequence injection...

openSUSE Security Advisory (SUSE-SU-2025:03082-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2025:03082-1 Security update for python-maturin

This update for python-maturin fixes the following issues: - CVE-2025-58160: terminal escape injection via ANSI sequences from untrusted input bsc1249011...

CVE-2022-47583

Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal...

CVE-2022-47583

Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal...

CVE-2022-47583

Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal...

CLSA-2022-1650377131 Fix CVE(s): CVE-2022-28391

SECURITY UPDATE: possible remote code execution - debian/patches/CVE-2022-28391.patch: fix possible terminal injection attacks from DNS query results - CVE-2022-28391...

CLSA-2022-1650377094 Fixed CVE-2022-28391 in busybox

CVE-2022-28391: fix possible terminal injection attacks from DNS query results...

CLSA-2022-1650376937 Fix of CVE: CVE-2022-28391

CVE-2022-28391: fix possible terminal injection attacks from DNS query results...

Fix of CVE: CVE-2022-28391

CVE-2022-28391: fix possible terminal injection attacks from DNS query results...

GHSA-C38G-469G-CMGX Improper Neutralization of Special Elements in Output in helm.sh/helm/v3

Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version...