Vulnerability in Spaceship-Prompt
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.
Published .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/spaceship-prompt/spaceship-prompt (product)
- github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fb… (technical-description)
- github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fb… (technical-description)
- github.com/spaceship-prompt/spaceship-prompt/issues/1567 (issue-tracking)
- www.vulncheck.com/advisories/spaceship-prompt-through-4.22.5-terminal-escape-se… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-100867?
- CVE-2026-100867 is a low-severity vulnerability in Spaceship-Prompt, classified under CWE-150. CVSS score: 3.3/10. Published 2026-09-27.
- How severe is CVE-2026-100867?
- Low severity. CVSS v3 base score is 3.3 out of 10.