cve-2024-52005-poc

CVE-2024-52005：Git 中的 ANSI 转义序列注入 概述 本仓库包含一个概念验证（PoC），用于演示 CVE-2024-52005——Git 中的一个漏洞，该漏洞允许在 Git 操作期间通过 sideband 通道注入 ANSI 转义序列。 CVE-2024-52005 是一个高危 （CVSS 7.5）漏洞，影响 2.48.1、2.47.3、2.46.5、2.45.4 和 2.44.3 之前的 Git 版本。 问题 创建此 PoC 是为了证明某些加固的容器镜像在其 VEX（漏洞可利用性交换，Vulnerability Exploitability...

CVE-2026-82710 Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...

CVE-2026-82584

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

CVE-2026-81707

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81707 openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

EUVD-2026-67063

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81707 openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email

opensslencrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows o...

CVE-2026-81707

openssl_encrypt versions before 1.4.9 fail to sanitize the email field in imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed in the terminal. The attack can be delivered through normal contact-exchange flows or ke...

PT-2026-82608

openssl encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows ...

Linux Distros Unpatched Vulnerability : CVE-2026-72847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call...

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

PT-2026-80742

Name of the Vulnerable Software and Affected Versions Ember affected versions not specified Description An unauthenticated remote attacker can inject terminal escape sequences into the operator's terminal user interface TUI by sending HTTP requests with control bytes in the request target to a...

Linux Distros Unpatched Vulnerability : CVE-2026-73480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file...

DEBIAN-CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

UBUNTU-CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...