CWE-150

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.commons:xwiki-commons-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1-milestone-1"
            },
            {
              "fixed": "13.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.commons:xwiki-commons-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0-rc-1"
            },
            {
              "fixed": "14.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.commons:xwiki-commons-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.5"
            },
            {
              "fixed": "14.7-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26055"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-03T22:49:27Z",
    "nvd_published_at": "2023-03-02T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nAny user can edit his own profile and inject code which is going to be executed with programming right.\n\nSteps to reproduce:\n\n* Set your first name to\n\n```\n    {{cache id=\"userProfile\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/cache}}\n```\n\nThe first name appears as interpreted \"`Hello from groovy`\" instead of the expected fully escaped \"`{{cache id=\"userProfile\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/cache}}`\".\n\nThe same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field.\n\n### Patches\nThe problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.\n\n### Workarounds\nThere are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-19793\n* https://jira.xwiki.org/browse/XWIKI-19794\n* https://jira.xwiki.org/browse/XCOMMONS-2498\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
  "id": "GHSA-8cw6-4r32-6r3h",
  "modified": "2023-03-03T22:49:27Z",
  "published": "2023-03-03T22:49:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26055"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-commons"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XCOMMONS-2498"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19793"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-19794"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XWiki Platform may allow privilege escalation to programming rights via user\u0027s first name"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/wrangler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.4-security1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.4"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/wrangler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "0.8.5-security1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/wrangler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/wrangler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.6"
            },
            {
              "fixed": "0.8.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-43756"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-25T19:40:26Z",
    "nvd_published_at": "2023-02-07T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`.\n\nSpecially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. \n\n### Workarounds\n\nA workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.\n\n### Patches\n\nPatched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-8fcj-gf77-47mg",
  "modified": "2023-02-07T15:50:58Z",
  "published": "2023-01-25T19:40:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43756"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8fcj-gf77-47mg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/policy"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/wrangler"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2023-1515"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of service (DoS) when processing Git credentials"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mongosh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1692"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-27T17:15:53Z",
    "nvd_published_at": "2025-02-27T13:15:11Z",
    "severity": "MODERATE"
  },
  "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user\u2019s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9.",
  "id": "GHSA-973h-3x6p-qg37",
  "modified": "2025-02-27T17:15:53Z",
  "published": "2025-02-27T15:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1692"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mongodb-js/mongosh"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/MONGOSH-2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MongoDB Shell may be susceptible to control character injection via pasting"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-41526"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-28T08:16:01Z",
    "severity": "MODERATE"
  },
  "details": "In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \\x01 can be used during injection.",
  "id": "GHSA-9hm5-8q4h-922j",
  "modified": "2026-04-28T09:34:13Z",
  "published": "2026-04-28T09:34:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41526"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L43-L49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KDE/kcoreaddons/releases/tag/v6.25.0"
    },
    {
      "type": "WEB",
      "url": "https://invent.kde.org/frameworks/kcoreaddons"
    },
    {
      "type": "WEB",
      "url": "https://kde.org/info/security/advisory-20260427-1.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.116.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.117.0"
            },
            {
              "fixed": "1.117.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gardener/gardener"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.118.0"
            },
            {
              "fixed": "1.118.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-47284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-19T21:09:32Z",
    "nvd_published_at": "2025-05-19T19:15:51Z",
    "severity": "CRITICAL"
  },
  "details": "A security vulnerability was discovered in the `gardenlet` component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.\n\n### Am I Vulnerable?\n\nThis CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.\n\n### Affected Components\n\n- `gardener/gardener` (`gardenlet`)\n\n### Affected Versions\n\n- \u003c v1.116.4\n- \u003c v1.117.5\n- \u003c v1.118.2\n- \u003c v1.119.0\n\n### Fixed Versions\n\n- \u0026gt;= v1.116.4\n- \u0026gt;= v1.117.5\n- \u0026gt;= v1.118.2\n- \u0026gt;= v1.119.0\n\n### How do I mitigate this vulnerability?\n\nUpdate to a fixed version.",
  "id": "GHSA-9x73-87fh-54w9",
  "modified": "2025-05-19T21:48:48Z",
  "published": "2025-05-19T21:09:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gardener/gardener/security/advisories/GHSA-9x73-87fh-54w9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gardener/gardener"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gardener allows metadata injection for a project secret which can lead to privilege escalation"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "islandora/crayfish"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-150",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-12T21:05:47Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nRemote code execution is possible in web-accessible installations of hypercube. \n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nNot yet, though no patch is neccessary if your installation of the microservices is behind a firewall.  See below.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe exploit requires making a request against Hypercube\u0027s endpoints; therefore, the ability to make use of the exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Hypercube.  Furthermore, if you\u0027ve used any of the official installation methods, your Crayfish will be behind a firewall and there is no work neccessary.\n\nThe webserver might be made to validate the structure of headers passed, but that would only be neccessary if you publicly exposed the endpoint. Standard security practices should be applied.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- XBOW-024-074",
  "id": "GHSA-c2p2-hgjg-9r3f",
  "modified": "2025-02-12T21:05:47Z",
  "published": "2025-02-12T21:05:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Islandora/Crayfish/security/advisories/GHSA-c2p2-hgjg-9r3f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Islandora/Crayfish"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-6932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150",
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-12T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to potentially read arbitrary files and run arbitrary executables in the context of the web server.",
  "id": "GHSA-chqw-c679-9rg5",
  "modified": "2025-08-22T18:31:10Z",
  "published": "2022-05-24T17:25:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6932"
    },
    {
      "type": "WEB",
      "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000061411"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cli/cli/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.92.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cli/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "last_affected": "1.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45803"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T19:37:01Z",
    "nvd_published_at": "2026-05-15T16:16:15Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using `gh run view --log` or `gh run view --log-failed`.\n\n### Details\n\nThe vulnerability stems from the way GitHub CLI handles raw Actions log output. The `gh run view --log` and `gh run view --log-failed` commands stream workflow log lines to stdout or the configured pager without sanitizing terminal control sequences. An attacker who can influence GitHub Actions log content, for example via a PR triggered workflow, can embed escape sequences that are replayed in the user\u0027s terminal when they inspect the run.\n\nDepending on the victim\u0027s terminal emulator, injected sequences could change the window title, manipulate on screen content, or in some terminal emulators (such as `screen`) potentially execute arbitrary commands.\n\nIn `2.92.0`, GitHub CLI sanitizes terminal control sequences in Actions log output before writing to the terminal.\n\n### PoC\n\nCreate a workflow that emits terminal escape sequences in its log output:\n\n```yaml\nname: Escape Sequence PoC\n\non:\n  workflow_dispatch:\n\njobs:\n  emit-escape-sequences:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Emit terminal escape sequences\n        run: |\n          # OSC title set\n          printf \u0027ESCAPE_MARKER_START \\033]0;HIJACKED_TITLE\\007 ESCAPE_MARKER_END\\n\u0027\n          # CSI color\n          printf \u0027ESCAPE_MARKER_START \\033[31mRED_TEXT\\033[0m ESCAPE_MARKER_END\\n\u0027\n          # Screen title set (enables command execution in screen terminal)\n          printf \u0027ESCAPE_MARKER_START \\033k;malicious command;\\033\\\\ ESCAPE_MARKER_END\\n\u0027\n```\n\nThen trigger the workflow and view its logs:\n\n```bash\ngh workflow run \u0027Escape Sequence PoC\u0027\ngh run view \u003crun_id\u003e --log\n```\n\nOn vulnerable versions, the raw ESC bytes (0x1b) are passed through to the terminal unsanitized. On `2.92.0` and later, escape sequences are stripped and only the safe visible text is displayed.\n\n### Impact\n\nAn attacker who can control GitHub Actions workflow output can inject terminal escape sequences into a maintainer\u0027s terminal session when they inspect the run with `gh run view --log` or `gh run view --log-failed`. The practical impact depends on the victim\u0027s terminal emulator.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.92.0`\n2. Pipe log output through a sanitizer (e.g., `gh run view --log | cat -v`) as a workaround on older versions\n3. Exercise caution when viewing logs from untrusted workflow runs",
  "id": "GHSA-crc3-h8v6-qh57",
  "modified": "2026-05-19T19:37:01Z",
  "published": "2026-05-19T19:37:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45803"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cli/cli"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-47090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-18T20:16:39Z",
    "severity": "LOW"
  },
  "details": "Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.",
  "id": "GHSA-f378-wf84-8j5h",
  "modified": "2026-05-18T21:31:51Z",
  "published": "2026-05-18T21:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47090"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jarrodwatts/claude-hud/issues/485"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jarrodwatts/claude-hud/pull/487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/claude-hud-terminal-injection-via-osc-8-hyperlinks"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0-alpha.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-25743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-07T23:58:59Z",
    "nvd_published_at": "2022-01-07T00:15:00Z",
    "severity": "LOW"
  },
  "details": "kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.",
  "id": "GHSA-f9jg-8p32-2f55",
  "modified": "2023-10-02T15:53:13Z",
  "published": "2022-01-08T00:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25743"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/issues/101695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/pull/112553"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/commit/dad0e937c0f76344363eb691b2668490ffef8537"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubernetes/kubernetes"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220217-0003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kubectl ANSI escape characters not filtered"
}