CWE-150
AllowedImproper Neutralization of Escape, Meta, or Control Sequences
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
134 vulnerabilities reference this CWE, most recent first.
GHSA-CRC3-H8V6-QH57
Vulnerability from github – Published: 2026-05-19 19:37 – Updated: 2026-05-19 19:37Summary
A security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed.
Details
The vulnerability stems from the way GitHub CLI handles raw Actions log output. The gh run view --log and gh run view --log-failed commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user's terminal when they inspect the run.
Depending on the victim's terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as screen) potentially execute arbitrary commands.
In 2.92.0, GitHub CLI sanitizes terminal control sequences in Actions log output before writing to the terminal.
PoC
Create a workflow that emits terminal escape sequences in its log output:
name: Escape Sequence PoC
on:
workflow_dispatch:
jobs:
emit-escape-sequences:
runs-on: ubuntu-latest
steps:
- name: Emit terminal escape sequences
run: |
# OSC title set
printf 'ESCAPE_MARKER_START \033]0;HIJACKED_TITLE\007 ESCAPE_MARKER_END\n'
# CSI color
printf 'ESCAPE_MARKER_START \033[31mRED_TEXT\033[0m ESCAPE_MARKER_END\n'
# Screen title set (enables command execution in screen terminal)
printf 'ESCAPE_MARKER_START \033k;malicious command;\033\\ ESCAPE_MARKER_END\n'
Then trigger the workflow and view its logs:
gh workflow run 'Escape Sequence PoC'
gh run view <run_id> --log
On vulnerable versions, the raw ESC bytes (0x1b) are passed through to the terminal unsanitized. On 2.92.0 and later, escape sequences are stripped and only the safe visible text is displayed.
Impact
An attacker who can control GitHub Actions workflow output can inject terminal escape sequences into a maintainer's terminal session when they inspect the run with gh run view --log or gh run view --log-failed. The practical impact depends on the victim's terminal emulator.
Remediation and Mitigation
- Upgrade
ghto2.92.0 - Pipe log output through a sanitizer (e.g.,
gh run view --log | cat -v) as a workaround on older versions - Exercise caution when viewing logs from untrusted workflow runs
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cli/cli/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.92.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/cli/cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"last_affected": "1.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45803"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-19T19:37:01Z",
"nvd_published_at": "2026-05-15T16:16:15Z",
"severity": "LOW"
},
"details": "### Summary\n\nA security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using `gh run view --log` or `gh run view --log-failed`.\n\n### Details\n\nThe vulnerability stems from the way GitHub CLI handles raw Actions log output. The `gh run view --log` and `gh run view --log-failed` commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user\u0027s terminal when they inspect the run.\n\nDepending on the victim\u0027s terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as `screen`) potentially execute arbitrary commands.\n\nIn `2.92.0`, GitHub CLI sanitizes terminal control sequences in Actions log output before writing to the terminal.\n\n### PoC\n\nCreate a workflow that emits terminal escape sequences in its log output:\n\n```yaml\nname: Escape Sequence PoC\n\non:\n workflow_dispatch:\n\njobs:\n emit-escape-sequences:\n runs-on: ubuntu-latest\n steps:\n - name: Emit terminal escape sequences\n run: |\n # OSC title set\n printf \u0027ESCAPE_MARKER_START \\033]0;HIJACKED_TITLE\\007 ESCAPE_MARKER_END\\n\u0027\n # CSI color\n printf \u0027ESCAPE_MARKER_START \\033[31mRED_TEXT\\033[0m ESCAPE_MARKER_END\\n\u0027\n # Screen title set (enables command execution in screen terminal)\n printf \u0027ESCAPE_MARKER_START \\033k;malicious command;\\033\\\\ ESCAPE_MARKER_END\\n\u0027\n```\n\nThen trigger the workflow and view its logs:\n\n```bash\ngh workflow run \u0027Escape Sequence PoC\u0027\ngh run view \u003crun_id\u003e --log\n```\n\nOn vulnerable versions, the raw ESC bytes (0x1b) are passed through to the terminal unsanitized. On `2.92.0` and later, escape sequences are stripped and only the safe visible text is displayed.\n\n### Impact\n\nAn attacker who can control GitHub Actions workflow output can inject terminal escape sequences into a maintainer\u0027s terminal session when they inspect the run with `gh run view --log` or `gh run view --log-failed`. The practical impact depends on the victim\u0027s terminal emulator.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.92.0`\n2. Pipe log output through a sanitizer (e.g., `gh run view --log | cat -v`) as a workaround on older versions\n3. Exercise caution when viewing logs from untrusted workflow runs",
"id": "GHSA-crc3-h8v6-qh57",
"modified": "2026-05-19T19:37:01Z",
"published": "2026-05-19T19:37:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45803"
},
{
"type": "PACKAGE",
"url": "https://github.com/cli/cli"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection"
}
GHSA-F378-WF84-8J5H
Vulnerability from github – Published: 2026-05-18 21:31 – Updated: 2026-05-18 21:31Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.
{
"affected": [],
"aliases": [
"CVE-2026-47090"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-18T20:16:39Z",
"severity": "LOW"
},
"details": "Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.",
"id": "GHSA-f378-wf84-8j5h",
"modified": "2026-05-18T21:31:51Z",
"published": "2026-05-18T21:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47090"
},
{
"type": "WEB",
"url": "https://github.com/jarrodwatts/claude-hud/issues/485"
},
{
"type": "WEB",
"url": "https://github.com/jarrodwatts/claude-hud/pull/487"
},
{
"type": "WEB",
"url": "https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/claude-hud-terminal-injection-via-osc-8-hyperlinks"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F9JG-8P32-2F55
Vulnerability from github – Published: 2022-01-08 00:00 – Updated: 2023-10-02 15:53kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.0-alpha.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25743"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-07T23:58:59Z",
"nvd_published_at": "2022-01-07T00:15:00Z",
"severity": "LOW"
},
"details": "kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.",
"id": "GHSA-f9jg-8p32-2f55",
"modified": "2023-10-02T15:53:13Z",
"published": "2022-01-08T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25743"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/101695"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/112553"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/commit/dad0e937c0f76344363eb691b2668490ffef8537"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220217-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "kubectl ANSI escape characters not filtered"
}
GHSA-FF77-26X5-69CR
Vulnerability from github – Published: 2025-04-28 21:30 – Updated: 2025-11-03 22:56Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.102"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.76"
},
{
"fixed": "9.0.104"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.10"
},
{
"fixed": "10.1.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M2"
},
{
"fixed": "11.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.102"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.76"
},
{
"fixed": "9.0.104"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.10"
},
{
"fixed": "10.1.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M2"
},
{
"fixed": "11.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-31651"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-29T15:03:25Z",
"nvd_published_at": "2025-04-28T20:15:20Z",
"severity": "LOW"
},
"details": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.\u00a0For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6, which fix the issue.",
"id": "GHSA-ff77-26x5-69cr",
"modified": "2025-11-03T22:56:57Z",
"published": "2025-04-28T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/066bf6b6a15a4e7e0941d4acf096841165b97098"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/175dc75fc428930034a6c93fb52f830d955d8e64"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/ee3ab548e92345eca0cbd1f01649eb36c6f29454"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/fbecc915a10c5a3d634c5e2c6ced4ff479ce9953"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/list.html?announce@tomcat.apache.org"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/04/28/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Apache Tomcat Rewrite rule bypass"
}
GHSA-FV2R-R8MP-PG48
Vulnerability from github – Published: 2025-11-06 23:48 – Updated: 2025-11-17 21:49Impact
In several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.
In the same token, git messages, when printed, are also not being sanitized.
Places in which this was found:
- Repository Description (pkg/backend/repo.go - SetDescription)
- Repository Project Name (pkg/backend/repo.go - SetProjectName)
- Git Commit Author Names (pkg/ssh/cmd/commit.go:69)
- Git Commit Messages (pkg/ssh/cmd/commit.go:71)
- Access Token Names (pkg/ssh/cmd/token.go:107)
- Webhook URLs (pkg/ssh/cmd/webhooks.go:72)
Patches
v0.11.0
Workarounds
No.
References
n/a
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.10.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/charmbracelet/soft-serve"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64494"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-06T23:48:12Z",
"nvd_published_at": "2025-11-08T02:15:35Z",
"severity": "MODERATE"
},
"details": "### Impact\nIn several places where the user can insert data (e.g. names), ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts.\n\nIn the same token, git messages, when printed, are also not being sanitized.\n\nPlaces in which this was found:\n\n1. Repository Description (pkg/backend/repo.go - SetDescription)\n2. Repository Project Name (pkg/backend/repo.go - SetProjectName)\n3. Git Commit Author Names (pkg/ssh/cmd/commit.go:69)\n4. Git Commit Messages (pkg/ssh/cmd/commit.go:71)\n5. Access Token Names (pkg/ssh/cmd/token.go:107)\n6. Webhook URLs (pkg/ssh/cmd/webhooks.go:72)\n\n### Patches\nv0.11.0\n\n### Workarounds\nNo.\n\n### References\nn/a",
"id": "GHSA-fv2r-r8mp-pg48",
"modified": "2025-11-17T21:49:09Z",
"published": "2025-11-06T23:48:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64494"
},
{
"type": "WEB",
"url": "https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549"
},
{
"type": "PACKAGE",
"url": "https://github.com/charmbracelet/soft-serve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Soft Serve does not sanitize ANSI escape sequences in user input"
}
GHSA-FWJX-9P69-H25H
Vulnerability from github – Published: 2026-07-24 22:35 – Updated: 2026-08-13 14:23Summary
Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)
Details
src/terminal/writer.go, write(s rune): the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in formats.EscapeSequences, which per shell contains only the shell's prompt-length markers (\ for bash, % for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC 0x1b, BEL 0x07, CSI, OSC) are written verbatim.
Oh My Posh's own styling is emitted through separate paths (writeEscapedAnsiString, writeColorise, builder.WriteString(formats.Hyperlink...)), so any control rune reaching write(s rune) originates from rendered data. trimAnsi is already applied to the console title (FormatTitle) but not to the prompt body.
Attacker-controlled sources (both verified)
- Current directory name (default config, Linux/macOS). Directory names may contain any byte except
/and NUL, including0x1b. The path segment renders the working directory in every theme. - Git commit subject / author / upstream URL (cross-platform, including Windows).
Git.Commit()runsgit log -1 --pretty=format:...su:%s...and exposes.Commit.Subject,.Commit.Author.Name/.Emailand.RawUpstreamURL; Git imposes no restriction on these, so they can carry raw escape sequences.
PoC
Git commit-subject vector (config: a single git segment with template {{ .Commit.Subject }}):
printf 'feat: \033]0;HACKED\007\033]52;c;ZWNobyBQV05FRA==\007 update' > msg.txt
git commit --allow-empty -F msg.txt
oh-my-posh print primary --config poc.omp.json --shell fish | xxd
Output (excerpt) shows the attacker's OSC 0 (set title) and OSC 52 (clipboard write) passed through unmodified, wrapped only in Oh My Posh's colors:
...255m feat: 1b5d 303b 4841 434b 4544 07 1b5d 3532 3b63 3b5a 574e ... 07 ...
ESC ] 0 ; H A C K E D BEL ESC ] 5 2 ; c ; <base64> BEL
The directory-name vector reproduces identically via the path segment.
Impact
The terminal interprets the injected sequences on every render, enabling, per emulator: clipboard hijacking (OSC 52 write, so a command placed in the clipboard runs when the victim pastes), prompt/screen spoofing, window-title manipulation, and terminal denial of service. Delivery is remote (repo/archive/share); execution is local when the prompt renders after cd.
Suggested fix: neutralize C0/C1 control characters in untrusted segment data before it reaches the terminal, at minimum the path segment (folder names) and the git segment (Commit.Subject, Commit.Author.*, RawUpstreamURL). trimAnsi already exists and is applied to the title; extending equivalent handling to segment data closes the gap. Filtering control runes in write(s rune) would also work as defense in depth (Oh My Posh's own styling never flows through that function), optionally behind an opt-out for users who deliberately embed escapes in their own templates.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 29.35.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/jandedobbeleer/oh-my-posh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "29.35.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73506"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:35:52Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nOh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim\u0027s terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)\n\n### Details\n`src/terminal/writer.go`, `write(s rune)`: the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in `formats.EscapeSequences`, which per shell contains only the shell\u0027s prompt-length markers (`\\` for bash, `%` for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC `0x1b`, BEL `0x07`, CSI, OSC) are written verbatim.\n\nOh My Posh\u0027s own styling is emitted through separate paths (`writeEscapedAnsiString`, `writeColorise`, `builder.WriteString(formats.Hyperlink...)`), so any control rune reaching `write(s rune)` originates from rendered data. `trimAnsi` is already applied to the console title (`FormatTitle`) but not to the prompt body.\n\n### Attacker-controlled sources (both verified)\n1. Current directory name (default config, Linux/macOS). Directory names may contain any byte except `/` and NUL, including `0x1b`. The path segment renders the working directory in every theme.\n2. Git commit subject / author / upstream URL (cross-platform, including Windows). `Git.Commit()` runs `git log -1 --pretty=format:...su:%s...` and exposes `.Commit.Subject`, `.Commit.Author.Name`/`.Email` and `.RawUpstreamURL`; Git imposes no restriction on these, so they can carry raw escape sequences.\n\n### PoC\nGit commit-subject vector (config: a single git segment with template `{{ .Commit.Subject }}`):\n\n```\nprintf \u0027feat: \\033]0;HACKED\\007\\033]52;c;ZWNobyBQV05FRA==\\007 update\u0027 \u003e msg.txt\ngit commit --allow-empty -F msg.txt\noh-my-posh print primary --config poc.omp.json --shell fish | xxd\n```\n\nOutput (excerpt) shows the attacker\u0027s OSC 0 (set title) and OSC 52 (clipboard write) passed through unmodified, wrapped only in Oh My Posh\u0027s colors:\n\n```\n...255m feat: 1b5d 303b 4841 434b 4544 07 1b5d 3532 3b63 3b5a 574e ... 07 ...\n ESC ] 0 ; H A C K E D BEL ESC ] 5 2 ; c ; \u003cbase64\u003e BEL\n```\n\nThe directory-name vector reproduces identically via the path segment.\n\n### Impact\nThe terminal interprets the injected sequences on every render, enabling, per emulator: clipboard hijacking (OSC 52 write, so a command placed in the clipboard runs when the victim pastes), prompt/screen spoofing, window-title manipulation, and terminal denial of service. Delivery is remote (repo/archive/share); execution is local when the prompt renders after cd.\n\nSuggested fix: neutralize C0/C1 control characters in untrusted segment data before it reaches the terminal, at minimum the path segment (folder names) and the git segment (`Commit.Subject`, `Commit.Author.*`, `RawUpstreamURL`). `trimAnsi` already exists and is applied to the title; extending equivalent handling to segment data closes the gap. Filtering control runes in `write(s rune)` would also work as defense in depth (Oh My Posh\u0027s own styling never flows through that function), optionally behind an opt-out for users who deliberately embed escapes in their own templates.",
"id": "GHSA-fwjx-9p69-h25h",
"modified": "2026-08-13T14:23:11Z",
"published": "2026-07-24T22:35:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
},
{
"type": "PACKAGE",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data"
}
GHSA-GCJM-C673-V7VJ
Vulnerability from github – Published: 2026-08-17 21:31 – Updated: 2026-08-17 21:31powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
{
"affected": [],
"aliases": [
"CVE-2026-75483"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T21:16:57Z",
"severity": "MODERATE"
},
"details": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.",
"id": "GHSA-gcjm-c673-v7vj",
"modified": "2026-08-17T21:31:27Z",
"published": "2026-08-17T21:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75483"
},
{
"type": "WEB",
"url": "https://github.com/romkatv/powerlevel10k/issues/2961"
},
{
"type": "WEB",
"url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
},
{
"type": "WEB",
"url": "https://github.com/romkatv/powerlevel10k"
},
{
"type": "WEB",
"url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GMJ6-6F8F-6699
Vulnerability from github – Published: 2024-12-23 17:54 – Updated: 2025-01-08 16:06A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.
To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.4"
},
"package": {
"ecosystem": "PyPI",
"name": "jinja2"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-56201"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-23T17:54:12Z",
"nvd_published_at": "2024-12-23T16:15:07Z",
"severity": "MODERATE"
},
"details": "A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja\u0027s sandbox is used.\n\nTo exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.",
"id": "GHSA-gmj6-6f8f-6699",
"modified": "2025-01-08T16:06:01Z",
"published": "2024-12-23T17:54:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/issues/1792"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pallets/jinja"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Jinja has a sandbox breakout through malicious filenames"
}
GHSA-GP37-M2C5-J775
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2024-08-20 18:31RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.
{
"affected": [],
"aliases": [
"CVE-2024-36052"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T17:15:09Z",
"severity": "HIGH"
},
"details": "RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.",
"id": "GHSA-gp37-m2c5-j775",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-21T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36052"
},
{
"type": "WEB",
"url": "https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983"
},
{
"type": "WEB",
"url": "https://www.rarlab.com/rarnew.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GRQV-QMHW-8PWC
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network.
{
"affected": [],
"aliases": [
"CVE-2026-26149"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T18:16:45Z",
"severity": "CRITICAL"
},
"details": "Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network.",
"id": "GHSA-grqv-qmhw-8pwc",
"modified": "2026-04-14T18:30:37Z",
"published": "2026-04-14T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26149"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-28
Strategy: Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Mitigation
When using output from an LLM, neutralize or strip escape codes before redirecting output to the terminal or other rendering engine that would process the codes. The neutralization could require that the character be printable and/or allowable whitespace, such as a carriage return or newline. Be deliberate about what to allow.
Mitigation
When using an LLM: during tokenizer training, suppress escape codes from the tokenizer's vocabulary. Depending on context, this could be accomplished by removing the codes from input to the tokenizer, or removing the map from the string to its token ID. It is generally unlikely that this removal would adversely affect the quality or correctness of what is generated, e.g. advice requests for terminal settings to change colors.
CAPEC-134: Email Injection
An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.
CAPEC-41: Using Meta-characters in E-mail Headers to Inject Malicious Payloads
This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more email functionality is included and abstracted from the user, this creates opportunities for attackers. Virtually all email applications do not list email header information by default, however the email header contains valuable attacker vectors for the attacker to exploit particularly if the behavior of the email client application is known. Meta-characters are hidden from the user, but can contain scripts, enumerations, probes, and other attacks against the user's system.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
CAPEC-93: Log Injection-Tampering-Forging
This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.