CVE-2026-19591 | High | 8.8 | 2026-09-01 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-… |
CVE-2026-72847 | Medium | 4.6 | 2026-08-20 | broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy()… |
CVE-2026-75483 | Low | 3.3 | 2026-08-17 | powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw esca… |
CVE-2026-73506 | Medium | 6.1 | 2026-08-13 | Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted att… |
CVE-2026-73414 | | | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` w… |
CVE-2026-73036 | Medium | 4.4 | 2026-08-11 | Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to… |
CVE-2026-73035 | Medium | 4.3 | 2026-08-10 | npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitra… |
CVE-2026-72913 | | | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the… |
CVE-2026-64654 | | | 2026-08-06 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull req… |
CVE-2026-39879 | High | 7.1 | 2026-07-20 | Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql… |
CVE-2026-62948 | Critical | 9.6 | 2026-07-15 | OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases… |
CVE-2026-49147 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes.
When ack prints a filename whose… |
CVE-2026-11373 | Critical | 9.1 | 2026-06-22 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant… |
CVE-2026-54057 | High | 7.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, inclu… |
CVE-2026-50639 | Medium | 6.5 | 2026-06-10 | Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions such as dogstats… |
CVE-2026-50638 | Critical | 9.1 | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions such as dogstat… |
CVE-2026-50637 | High | 8.2 | 2026-06-10 | Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.
The statsd protocol (and extensions) allow mutiple met… |
CVE-2026-9270 | Critical | 9.1 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of… |
CVE-2026-11362 | Critical | 9.8 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.
DataDog::DogStatsd does not properly sanitise input, allowing metri… |
CVE-2026-46741 | High | 7.5 | 2026-06-04 | Etsy::StatsD versions through 1.002002 for Perl allow metric injections.
The metric names and values are not checked for newlines, colons or pipes. Metrics ge… |
CVE-2026-46739 | Medium | 5.3 | 2026-06-04 | Net::Statsd versions before 0.13 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics generated from untr… |
CVE-2026-8722 | Medium | 6.5 | 2026-06-04 | Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics ge… |
CVE-2026-46740 | Medium | 5.3 | 2026-05-26 | Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or… |
CVE-2026-47090 | Medium | 4.6 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping… |
CVE-2026-8788 | High | 7.3 | 2026-05-18 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
The values from the set_add method were not checked for newlines, colons or pipe… |
CVE-2026-46720 | High | 8.2 | 2026-05-17 | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
The metric names and set values were not checked for newlines, colons or pipes. Me… |
CVE-2026-46719 | Medium | 6.5 | 2026-05-16 | Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
The metric names were not checked for newlines, colons or pipes. Metrics generated… |
CVE-2026-45038 | High | 7.8 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dra… |
CVE-2026-45803 | Low | 3.5 | 2026-05-15 | `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal… |
CVE-2026-41526 | Medium | 6.5 | 2026-04-28 | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not ad… |
CVE-2026-6019 | Medium | 6.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sen… |
CVE-2026-40505 | Low | 3.3 | 2026-04-16 | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metada… |
CVE-2026-26149 | Critical | 9.0 | 2026-04-14 | Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network. |
CVE-2026-35651 | Medium | 4.3 | 2026-04-10 | OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof termin… |
CVE-2026-3108 | High | 8.0 | 2026-03-26 | Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl comman… |
CVE-2025-62845 | Medium | 6.7 | 2026-03-20 | An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator ac… |
CVE-2026-25996 | Critical | 9.8 | 2026-02-12 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields fro… |
CVE-2025-15311 | High | 7.8 | 2026-02-05 | Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. |
CVE-2026-21521 | High | 7.4 | 2026-01-22 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-23829 | Medium | 5.3 | 2026-01-19 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficien… |
CVE-2026-21439 | Medium | 5.3 | 2026-01-06 | badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content wi… |
CVE-2025-65082 | Medium | 6.5 | 2025-12-05 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuratio… |
CVE-2025-64494 | Medium | 4.6 | 2025-11-08 | Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names… |
CVE-2025-55754 | Critical | 9.6 | 2025-10-27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.
Tomcat did not escape ANSI escape sequences in log messages. If… |
CVE-2025-58160 | | | 2025-08-29 | tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber w… |
CVE-2025-55193 | | | 2025-08-13 | Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be… |
CVE-2024-47252 | High | 7.5 | 2025-07-10 | Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters… |
CVE-2025-47284 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` comp… |
CVE-2024-58251 | Low | 2.5 | 2025-04-23 | In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a d… |
CVE-2025-30089 | Medium | 5.4 | 2025-03-17 | gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences. |
CVE-2025-0975 | High | 8.8 | 2025-02-28 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters. |
CVE-2025-1693 | Low | 3.9 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control charac… |
CVE-2025-1692 | Medium | 6.3 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text… |
CVE-2025-25286 | Critical | 9.8 | 2025-02-13 | Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code e… |
CVE-2024-52005 | High | 8.8 | 2025-01-15 | Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git… |
CVE-2024-52006 | High | 7.5 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2024-50349 | Medium | 4.7 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2025-23026 | Medium | 6.1 | 2025-01-13 | jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or scrip… |
CVE-2024-9774 | Medium | 6.5 | 2024-12-27 | A vulnerability was found in python-sql where unary operators do not escape non-Expression. |
CVE-2024-56201 | High | 8.8 | 2024-12-23 | Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the c… |
CVE-2024-43785 | Low | 2.5 | 2024-08-22 | gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein comman… |
CVE-2024-36052 | High | 7.5 | 2024-05-21 | RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899. |
CVE-2024-32986 | Critical | 9.6 | 2024-05-03 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as… |
CVE-2024-33899 | High | 7.1 | 2024-04-29 | RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences. |
CVE-2024-28085 | Low | 3.3 | 2024-03-27 | wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Speci… |
CVE-2024-27936 | High | 8.8 | 2024-03-21 | Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, mal… |
CVE-2023-40185 | Medium | 6.5 | 2023-08-23 | shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result… |
CVE-2023-3265 | Critical | 9.8 | 2023-08-14 | An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login int… |
CVE-2023-39342 | Low | 3.6 | 2023-08-08 | Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs… |
CVE-2023-30844 | Low | 3.0 | 2023-05-08 | Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to v… |
CVE-2023-28446 | High | 8.8 | 2023-03-24 | Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering… |
CVE-2023-26055 | Critical | 9.9 | 2023-03-02 | XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profil… |
CVE-2022-30123 | Critical | 10.0 | 2022-12-05 | A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger com… |
CVE-2021-25743 | Low | 3.0 | 2022-01-07 | kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstr… |
CVE-2021-25310 | High | 8.8 | 2021-02-02 | The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands wit… |
CVE-2020-6932 | Critical | 10.0 | 2020-08-12 | An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0… |
CVE-2017-0899 | Critical | 9.8 | 2017-08-31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specifica… |