EUVD-2026-67050

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

GHSA-X3G7-QRWC-F6C5 Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

EUVD-2026-63488

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847

broot , a terminal-based file tree viewer, is vulnerable to terminal escape sequence injection via unsanitized file and directory names. The tree view renders names using a plain to_string_lossy() call in src/tree_build/builder.rs and TreeLine::unprune in src/tree/tree_line.rs, with no control-ch...

PT-2026-79075

Name of the Vulnerable Software and Affected Versions broot affected versions not specified Description broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process...

EUVD-2026-60395

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-73479

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480

CVE-2026-73480 affects gdu. The issue is that gdu fails to strip terminal escape sequences from directory and file names when printing paths after exiting the TUI, allowing attackers to craft names with escape sequences that a terminal may interpret. This can enable title spoofing, clipboard mani...

PT-2026-71872

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

PT-2026-71877

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

EUVD-2026-55804

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035

The CVE-2026-73035 vulnerability affects npm-check-updates up to version 23.0.2. A terminal escape sequence injection flaw exists in dependency homepage/repo URL fields, allowing unfiltered control characters to be emitted to the terminal when using --format homepage or --format repo. This can en...

CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...