CWE-150

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T10:24:27.267671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T10:26:12.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "app/Console/Command/CLIShell/"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Console/Command/CLIShell.php",
            "app/Console/Command/CLIShell/cli_attributes.php",
            "app/Console/Command/CLIShell/cli_common.php",
            "app/Console/Command/CLIShell/cli_events.php",
            "app/Console/Command/CLIShell/cli_objects.php",
            "app/Console/Command/CLIShell/cli_organisations.php",
            "app/Console/Command/CLIShell/cli_roles.php",
            "app/Console/Command/CLIShell/cli_tags.php",
            "app/Console/Command/CLIShell/cli_users.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.46",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Scottish Government - National Cyber Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.\u003c/p\u003e\n\u003cp\u003eThe patch shows that CLI access could differ from the web application in multiple security-sensitive areas:\u003c/p\u003e\u2003- feed listings did not enforce the same \u003ccode\u003elookup_visible\u003c/code\u003e restrictions for non-host-organisation users;\u003cbr\u003e\u2003- feed detail access did not enforce the same host-organisation/site-admin authorization as \u003ccode\u003eFeedsController::view()\u003c/code\u003e;\u003cbr\u003e\u003ccode\u003e\u2003- Feed.headers\u003c/code\u003e, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;\u003cbr\u003e\u2003- server synchronization \u003ccode\u003eauthkey\u003c/code\u003e values were not explicitly hidden from CLI detail output;\u003cbr\u003e\u2003- sharing-group detail access did not consistently use \u003ccode\u003eSharingGroup::checkIfAuthorised()\u003c/code\u003e;\u003cbr\u003e\u2003- the \u003ccode\u003euse\u003c/code\u003e command could establish context for a record without first proving that the user was authorized to view that record\u003cul\u003e\n\u003c/ul\u003e\u003cp\u003eThe commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Affected versions of MISP\u2019s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies.\n\n\nThe patch shows that CLI access could differ from the web application in multiple security-sensitive areas:\n\n\u2003- feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;\n\u2003- feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();\n\u2003- Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;\n\u2003- server synchronization authkey values were not explicitly hidden from CLI detail output;\n\u2003- sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();\n\u2003- the use command could establish context for a record without first proving that the user was authorized to view that record\n\n\nThe commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch.\n\nVersion affected: \u22642.5.45"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Quote, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T09:40:55.800Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cd9f548ed"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.\u003c/p\u003e"
            }
          ],
          "value": "The fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets."
        }
      ],
      "title": "MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CLI shell is accessible to any authenticated MISP user with local/SSH access to the server; no additional authentication layer is assumed.",
                  "The affected version range is not precisely bounded; the fix commit is 184 commits after tag v2.5.46, but the exact release version containing the fix is not stated in the patch metadata.",
                  "CVSS assumes the attacker already possesses a low-privilege MISP account and local shell access; remote exploitation without local access is not assessed.",
                  "The terminal injection impact (VC:H) is assessed on the basis that an analyst\u0027s terminal session is the primary trust boundary for indicator review; in automated/piped contexts the impact may be lower.",
                  "The unguarded write path is assessed as allowing modification of any readable record, not limited to specific entity types, based on the patch comment stating \u0027a user rewrite any record they could read\u0027."
                ],
                "commit": "cd9f548ed808f89e4e018fad9a81a628098d73fb",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Scottish Government - National Cyber Team"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:L: The CLI shell is a local console command requiring SSH or local shell access to the MISP server. AC:L: No race conditions or special timing are needed; the unguarded write path and missing ACL checks are deterministic. AT:N: The authorization bypass and credential exposure require no target interaction. PR:L: Any authenticated MISP user with basic permissions (perm_add) can exploit the write bypass and read credential columns. UI:N: The core authorization bypass and data exposure do not require the victim to perform any action. VC:H: Sensitive credentials (feed HTTP auth, server sync key, user passwords/TOTP) are exposed. VI:H: An attacker can modify events, attributes, and objects they should not be able to change. VA:H: An attacker can read records (feeds, organisations, hidden tags) outside their authorized scope. SC/SI/SA:N: Impact is confined to the local MISP instance and its data.",
                "draft": false,
                "fixSummary": "The fix replaces the shell\u0027s hand-rolled authorization logic with the same model-level accessors used by the web interface (Event::fetchSimpleEvent, MispAttribute::fetchAttributes, MispObject::fetchObjects, SharingGroup::checkIfAuthorised, Organisation::canSee), ensuring read and write operations enforce identical ACL rules. Credential columns are excluded at the query level via a hiddenFields mechanism so they are never fetched from the database. The inline detail editor now delegates to the entity-specific edit handlers, which enforce per-record write authorization. All terminal output passes through a sanitiser that neutralises C0/C1 control characters, ANSI escape sequences, and Unicode bidirectional overrides. Pagination is clamped to a safe range (1-1000) to prevent unbounded result sets.",
                "generatedAt": "2026-09-14T09:16:49.402134Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "1993ed3ac039d8fca56d636755584952f47c43046158fdd08278e2e308f1bad1",
                "patchSummary": "Replaced hand-rolled ACL conditions in attribute, object, feed, sharing-group, and organisation queries with calls to the model\u0027s authorized fetch methods (fetchAttributes, fetchObjects, fetchSimpleEvent, checkIfAuthorised, canSee). Added hiddenFields configuration for server (authkey), feed (headers), and user (password, authkey, totp, hotp_counter, external_auth_key) so credential columns are excluded from SQL SELECT. Added __detailFields() to build the field list excluding hidden columns. Rewrote __editDetailField() to delegate to entity-specific edit handlers with a $fields parameter, eliminating the unguarded direct save(). Added __canWriteEntity() and __denyWrite() as a unified write-authorization gate for add/edit/delete. Added __term() sanitiser applied via overridden out()/err() methods and __termRows() for list data, neutralising C0/C1 controls, DEL, and Unicode bidi characters. Added __normalisePagination() to clamp limit to 1-1000 and page to \u003e=1. Added __warnUnsupportedFilters() to report ignored",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "cd9f548ed808f89e4e018fad9a81a628098d73fb",
                    "patchSha256": "1993ed3ac039d8fca56d636755584952f47c43046158fdd08278e2e308f1bad1",
                    "source": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                    "subject": "fix: [cli] Route interactive CLI shell authorization through"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/cd9f548ed.patch",
                "subject": "fix: [cli] Route interactive CLI shell authorization through",
                "tagVersionBoundary": {
                  "commits_after_fix": 184,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.46",
                  "version": "2.5.46",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The primary vulnerability: the inline detail editor saved records without enforcing per-record write authorization, and list/detail queries used incomplete ACL conditions that did not match the web interface\u0027s access rules. A user who could read a record could modify it, and could read records (feeds, organisations, tags) the web would not expose."
                  },
                  {
                    "cweId": "CWE-200",
                    "rationale": "Credential columns (Feed.headers, Server.authkey, User.password/authkey/totp/hotp_counter/external_auth_key) were fetched from the database and exposed in CLI output to users who should not have access, and organisation/tag visibility settings were not enforced."
                  },
                  {
                    "cweId": "CWE-150",
                    "rationale": "Database values containing ANSI escape sequences, C0/C1 control characters, or Unicode bidirectional override characters were printed verbatim to the terminal, allowing output forgery, window retitling, and visual manipulation of displayed indicators."
                  },
                  {
                    "cweId": "CWE-400",
                    "rationale": "A limit value of zero, negative, or non-numeric caused the ORM to omit the SQL LIMIT clause, returning the entire table into memory and enabling denial of service."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20058"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-90895",
    "datePublished": "2026-09-14T09:40:55.800Z",
    "dateReserved": "2026-09-14T09:40:52.456Z",
    "dateUpdated": "2026-09-14T10:26:12.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/procs",
          "product": "procs",
          "vendor": "dalance",
          "versions": [
            {
              "lessThanOrEqual": "0.14.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users\u0027 terminals for interpretation by terminal emulators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T10:45:43.955Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #950",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dalance/procs/issues/950"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dalance/procs"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836"
        },
        {
          "name": "VulnCheck Advisory: procs through 0.14.12 Terminal Escape Sequence Injection via Command",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/procs-through-0.14.12-terminal-escape-sequence-injection-via-command"
        }
      ],
      "title": "procs through 0.14.12 Terminal Escape Sequence Injection via Command",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-90773",
    "datePublished": "2026-09-13T10:45:43.955Z",
    "dateReserved": "2026-09-13T10:14:58.418Z",
    "dateUpdated": "2026-09-13T10:45:43.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:45:15.853850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:45:23.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
          ],
          "packageName": "usage_rules",
          "packageURL": "pkg:hex/usage_rules",
          "product": "usage_rules",
          "programFiles": [
            "lib/mix/tasks/usage_rules.search_docs.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
            }
          ],
          "repo": "https://github.com/ash-project/usage_rules",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "1.2.8",
              "status": "affected",
              "version": "0.1.18",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
          ],
          "packageName": "ash-project/usage_rules",
          "packageURL": "pkg:github/ash-project/usage_rules",
          "product": "usage_rules",
          "programFiles": [
            "lib/mix/tasks/usage_rules.search_docs.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
            }
          ],
          "repo": "https://github.com/ash-project/usage_rules",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb",
              "status": "affected",
              "version": "2da7a99536041d63ec1f391d019565789a59595f",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad \u003ccode\u003e--everywhere\u003c/code\u003e search).\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search)."
            }
          ],
          "value": "Reachable only when a developer runs mix usage_rules.search_docs in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad --everywhere search)."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.8",
                  "versionStartIncluding": "0.1.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e searches Hex documentation through \u003ccode\u003esearch.hexdocs.pm\u003c/code\u003e, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in \u003ccode\u003eMix.Tasks.UsageRules.SearchDocs\u003c/code\u003e interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\u003c/p\u003e\n\u003cp\u003eThis issue affects usage_rules: from 0.1.18 before 1.2.8.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
            }
          ],
          "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-93",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-93 Log Injection-Tampering-Forging"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T00:23:36.912Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82710.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82710"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82710",
    "datePublished": "2026-09-08T00:23:36.912Z",
    "dateReserved": "2026-09-07T20:30:01.990Z",
    "dateUpdated": "2026-09-08T14:45:23.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:44:50.539017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:44:59.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "igniter",
          "packageURL": "pkg:hex/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.8.4",
              "status": "affected",
              "version": "0.8.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "ash-project/igniter",
          "packageURL": "pkg:github/ash-project/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "d492b1aa33f8fb0dacc0afa41b703fb922d42816",
              "status": "affected",
              "version": "d26d9b3a8348661813617606076315075d32663b",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix igniter.install\u003c/code\u003e against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
            }
          ],
          "value": "Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.4",
                  "versionStartIncluding": "0.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the \u003ccode\u003emix igniter.install\u003c/code\u003e confirmation prompt.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix igniter.install\u003c/code\u003e prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in \u003ccode\u003eIgniter.Project.Deps\u003c/code\u003e wrote publisher-controlled fields (\u003ccode\u003emeta.description\u003c/code\u003e, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\u003c/p\u003e\n\u003cp\u003eThis issue affects igniter: from 0.8.1 before 0.8.4.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt.\n\n`mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
            }
          ],
          "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\n\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-93",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-93 Log Injection-Tampering-Forging"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T22:54:48.222Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82584.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82584"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82584",
    "datePublished": "2026-09-07T22:54:48.222Z",
    "dateReserved": "2026-09-07T21:00:01.988Z",
    "dateUpdated": "2026-09-08T14:44:59.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:41:48.476060Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:24:24.081Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "powerlevel10k",
          "repo": "https://github.com/romkatv/powerlevel10k",
          "vendor": "romkatv",
          "versions": [
            {
              "lessThanOrEqual": "1.20.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T00:44:22.288Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2961",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/romkatv/powerlevel10k/issues/2961"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/romkatv/powerlevel10k"
        },
        {
          "name": "bug fix: slap (V) on the content of `package` (#2961)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
        },
        {
          "name": "prompt_package in internal/p10k.zsh",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
        },
        {
          "name": "VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
        }
      ],
      "title": "powerlevel10k Control Character Injection via package.json Version",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-75483",
    "datePublished": "2026-08-17T20:36:08.150Z",
    "dateReserved": "2026-08-17T19:59:23.461Z",
    "dateUpdated": "2026-08-20T15:24:24.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73506",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:35:29.639961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:37:42.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oh-my-posh",
          "vendor": "JanDeDobbeleer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 29.35.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T14:23:02.176Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fwjx-9p69-h25h",
        "discovery": "UNKNOWN"
      },
      "title": "Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73506",
    "datePublished": "2026-08-13T14:23:02.176Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-14T15:37:42.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T22:11:19.562894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T22:11:29.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shescape",
          "vendor": "ericcornelissen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T19:42:55.520Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/pull/2649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/pull/2649"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/pull/2651",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/pull/2651"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-w4hw-qcx7-56pr",
        "discovery": "UNKNOWN"
      },
      "title": "Shescape: Shell injection via unescaped parentheses on Windows with CMD"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73414",
    "datePublished": "2026-08-12T19:42:55.520Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-14T22:11:29.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:58:17.355111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:58:27.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Bash-it",
          "vendor": "Bash-it",
          "versions": [
            {
              "lessThanOrEqual": "3.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme\u0027s Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T19:37:12.133Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Product Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/Bash-it/bash-it"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Bash-it/bash-it/commit/fab8f57818f28bfc6f2a81f86a58981c4ea72e5a"
        },
        {
          "name": "GitHub Issue",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/Bash-it/bash-it/issues/2396"
        },
        {
          "name": "Pull Request",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Bash-it/bash-it/pull/2397"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bash-it-barbuk-theme-terminal-escape-sequence-injection-via-pyproject-toml"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-73036",
    "datePublished": "2026-08-11T19:37:12.133Z",
    "dateReserved": "2026-08-10T18:48:59.023Z",
    "dateUpdated": "2026-08-12T12:58:27.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73035",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T14:34:35.312398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T14:34:44.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/raineorshine/npm-check-updates",
          "product": "npm-check-updates",
          "repo": "https://github.com/raineorshine/npm-check-updates",
          "vendor": "raineorshine",
          "versions": [
            {
              "lessThanOrEqual": "23.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "b554b84848fc0b08a9d2b3d3db15e351387168cf",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency\u0027s package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T20:19:40.888Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/raineorshine/npm-check-updates/issues/1988"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/raineorshine/npm-check-updates/pull/1994"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/raineorshine/npm-check-updates/commit/b554b84848fc0b08a9d2b3d3db15e351387168cf"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/npm-check-updates-terminal-injection-via-unsanitized-escape-sequences"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-73035",
    "datePublished": "2026-08-10T20:19:40.888Z",
    "dateReserved": "2026-08-10T18:48:59.023Z",
    "dateUpdated": "2026-08-11T14:34:44.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72913",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T15:57:25.058735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T15:59:44.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kitty",
          "vendor": "kovidgoyal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.48.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell\u0027s stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T21:07:29.557Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94"
        },
        {
          "name": "https://github.com/kovidgoyal/kitty/commit/9dca948e9bec3c926ab3370f2cd10f9b9b10821f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kovidgoyal/kitty/commit/9dca948e9bec3c926ab3370f2cd10f9b9b10821f"
        },
        {
          "name": "https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2"
        },
        {
          "name": "https://sw.kovidgoyal.net/kitty/changelog/#id1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sw.kovidgoyal.net/kitty/changelog/#id1"
        }
      ],
      "source": {
        "advisory": "GHSA-ccp2-q4v6-rw94",
        "discovery": "UNKNOWN"
      },
      "title": "Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-72913",
    "datePublished": "2026-08-10T21:07:29.557Z",
    "dateReserved": "2026-08-10T17:57:26.143Z",
    "dateUpdated": "2026-08-11T15:59:44.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}