CWE-150: ANSI injection
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
Also known as Improper Neutralization of Escape, Meta, or Control Sequences.
A kind of CWE-138 Improper Neutralization of Special Elements.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in... 5.3 Medium
- canop dysk dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata 1.0 Low
- hexpm hex Terminal escape sequence injection in Hex via unneutralized server-supplied output 2.3 Low
- openprinting cups CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) 2.5 Low
- openapi-generators openapi-python-client openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation 8.4 High
- meta platforms, inc sapling scm In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in... 7.8 High
-
collectlDebian Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances 7.7 High - thephpleague flysystem Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter 3.5 Low
- spaceship-prompt spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection 4.8 Medium
- o2sh onefetch onefetch through 2.28.1 Terminal Escape Sequence Injection 4.8 Medium
- mesop-dev mesop Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint 5.3 Medium
- misp MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection 8.4 High
- dalance procs procs through 0.14.12 Terminal Escape Sequence Injection via Command 2.4 Low
- ash-project usage rules Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata 2.3 Low
- ash-project igniter Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata 2.3 Low
- openai codex cli, codex desktop, codex desktop (microsoft store package) +2 more OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS... 8.8 High
-
pickemnpm pickem vulnerable to terminal escape-sequence injection via unsanitized item text 8.6 High - alexandre-daubois ember Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI 4.7 Medium
- canop broot broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View 2.4 Low
- romkatv powerlevel10k powerlevel10k Control Character Injection via package.json Version 4.8 Medium
- bash-it Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml 4.6 Medium
- kitty project kitty Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences 7.3 High
- raineorshine npm-check-updates npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences 5.3 Medium
- cli GitHub CLI: Terminal escape sequence injection in multiple `gh` commands 5.3 Medium
- jandedobbeleer oh-my-posh Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data 6.1 Medium
- ericcornelissen shescape Shescape: Shell injection via unescaped parentheses on Windows with CMD 9.2 Critical
- syslog-ng SQL injection in syslog-ng SQL destionation driver 7.1 High
- openwrt OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI 9.6 Critical
- jasei net::statsite::client Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections 9.1 Critical
- kitty project kitty Kitty vulnerable to command injection via unsanitized OSC 21 query reply 7.3 High
- pevans metrics::any::adapter::signalfx, metrics\ +1 more Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections 6.5 Medium
- pevans metrics::any::adapter::dogstatsd, metrics\ +1 more Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections 9.1 Critical
- pevans metrics::any::adapter::statsd, metrics\ +1 more Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections 8.2 High
- petdance app::ack App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes 7.5 High
- binary datadog::dogstatsd, datadog\ +1 more DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags 9.8 Critical
- binary datadog::dogstatsd, datadog\ +1 more DataDog::DogStatsd versions through 0.07 for Perl allow metric injections 9.1 Critical
- sanbeg etsy::statsd, etsy\ +1 more Etsy::StatsD versions through 1.002002 for Perl allow metric injections 7.5 High
- cosimo net::statsd, net\ +1 more Net::Statsd versions before 0.13 for Perl allow metric injections 5.3 Medium
- team net::async::statsd::client, net\ +1 more Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections 6.5 Medium
- rrwo mojolicious::plugin::statsd Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections 5.3 Medium
- jarrodwatts claude hud, claude-hud +1 more Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks 2.4 Low
- rrwo net::statsd::lite Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections 7.3 High
- rrwo net::statsd::tiny Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections 8.2 High
- rrwo net::statsd::lite Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections 6.5 Medium
- eugeny tabby Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution 8.4 High
- cli gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection 3.5 Low
- kde kcoreaddons In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that... 6.5 Medium
- python, python software foundation cpython +1 more BaseCookie.js_output() does not neutralize embedded characters 2.1 Low
- artifex mupdf MuPDF < 1.27 mutool ANSI Injection via Metadata 4.8 Medium
- microsoft power apps desktop client, power apps +1 more Microsoft Power Apps Desktop Client Spoofing Vulnerability 9.0 Critical
- Show olderLoading…