SUSE CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100866

A flaw was found in onefetch. An attacker can manipulate terminal output by embedding control characters and escape sequences into project manifest fields, such as the project name or version. When a user runs onefetch in an untrusted repository, these unsanitized values are printed directly to t...

CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-100867 spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

EUVD-2026-87938

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

PT-2026-99536

Name of the Vulnerable Software and Affected Versions onefetch versions prior to 2.28.2 Description The software writes repository information field values to the terminal without removing control characters, which enables terminal escape sequence injection. Attackers can embed ANSI/OSC escape...

CVE-2026-100867: Improper Neutralization of Escape, Meta, or Control Sequences

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof...

MAL-2025-176587 Malicious code in nuilva-avm-rucasiva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb806950b93c7f942d8cf226ea765feddcd582eb86f50200234aa33042f46f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-nana54 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7daf2a15481f17906fb33594f60fa8749bd60b99cb9047fd16f08a0bc514135b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162872 Malicious code in nokire-loklok20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89b0af9676c19ced3467255a64d0b8ca21b77ab2e0e930c3983d5e0611ad8693 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_cardinal_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d6d7042482402b3b24a95fa30e0e936a25a249643bd8b0f5a375a43939480e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-rawon42-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76d64a23df2002f08d9bf2ec529c54c5d09246a5a579cd4e9dc921624cf04637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108033 Malicious code in riana-nasi62-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b50574c09d0f768908483af0506862c7ee39b902fc270dba6bfd0e03a8733d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107703 Malicious code in rainy_tortoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be04aaa391c12bd6d586f92ad274b8260a23aafd81624ec66c3ae715bc2cd041 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agreeable_boar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4053b8b4e6df0324ac428627540038bcffe278fd267f26c5eebe36476a91488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83113 Malicious code in agus-ubi33-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac7b81a7496fef0c12f7d192dd8ccc6655376a12ae2cfe7b360b1371182cc5c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85696 Malicious code in free_moth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87ab434b021c3e11c8134ede79284764139c2ee79d73628c91a55121ec70513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-menjes85-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ad4e6a93fb5695e059d975f20eaf6eb23857177e2474b7cc278c76d35f70e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...