DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847

broot , a terminal-based file tree viewer, is vulnerable to terminal escape sequence injection via unsanitized file and directory names. The tree view renders names using a plain to_string_lossy() call in src/tree_build/builder.rs and TreeLine::unprune in src/tree/tree_line.rs, with no control-ch...

EUVD-2026-63488

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

PT-2026-79075

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to string lossy call in src/tree build/builder.rs and in TreeLine::unprune in src/tree/tree line.rs, and no control-character filtering exists anywhere in...

EUVD-2026-60395

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

CVE-2026-73479

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480

CVE-2026-73480 affects gdu. The issue is that gdu fails to strip terminal escape sequences from directory and file names when printing paths after exiting the TUI, allowing attackers to craft names with escape sequences that a terminal may interpret. This can enable title spoofing, clipboard mani...

PT-2026-71877

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

PT-2026-71872

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

EUVD-2026-55804

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035

The CVE-2026-73035 vulnerability affects npm-check-updates up to version 23.0.2. A terminal escape sequence injection flaw exists in dependency homepage/repo URL fields, allowing unfiltered control characters to be emitted to the terminal when using --format homepage or --format repo. This can en...

PT-2026-69948

Name of the Vulnerable Software and Affected Versions npm-check-updates versions prior to 23.0.3 Description An issue exists where an attacker can embed arbitrary terminal control characters within the homepage or repository URL fields of a dependency's package.json file. When a developer execute...

Linux Distros Unpatched Vulnerability : CVE-2026-66486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member...

CVE-2026-59224

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...