CWE-150.

dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

• Canop dysk
• CWE-150

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

• OpenPrinting cups
• Other injection
• Code injection

Terminal escape sequence injection in Hex via unneutralized server-supplied output

• hex
• CWE-150

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

• Code injection
• CWE-116

<0.29.1 · fixed in 0.29.1

Meta Platforms, Inc Sapling SCM: In Sapling SCM prior to v0.2.20260929-102736…

• Meta Platforms, Inc Sapling SCM
• CWE-150

Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

• CWE-150

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

• CWE-150

<3.35.3 · fixed in 3.35.3

spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

• spaceship-prompt
• CWE-150

onefetch through 2.28.1 Terminal Escape Sequence Injection

• o2sh onefetch
• CWE-150

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

• Other injection
• CWE-150

<1.3.4 · fixed in 1.3.4

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

• MISP
• Information disclosure
• Hard-coded credentials

procs through 0.14.12 Terminal Escape Sequence Injection via Command

• dalance procs
• CWE-150

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

• CWE-150

>=0.1.18, <1.2.8 · fixed in 1.2.8

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

• CWE-150

>=0.8.1, <0.8.4 · fixed in 0.8.4

OpenAI Codex CLI: OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS…

• OpenAI Codex CLI
• OpenAI Codex Desktop
• CWE-150

pickem vulnerable to terminal escape-sequence injection via unsanitized item text

• CWE-150

<1.0.7 · fixed in 1.0.7

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

• CWE-150

<1.4.2 · fixed in 1.4.2

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

• Canop broot
• CWE-150

powerlevel10k Control Character Injection via package.json Version

• romkatv powerlevel10k
• CWE-150

Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

• Bash-it
• CWE-150

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

• kovidgoyal kitty
• Command injection
• Other injection

npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

• raineorshine npm-check-updates
• CWE-150

GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

• cli
• CWE-150

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

• CWE-150

<29.35.1 · fixed in 29.35.1

Shescape: Shell injection via unescaped parentheses on Windows with CMD

• Command injection
• CWE-150

<2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

SQL injection in syslog-ng SQL destionation driver

• syslog-ng
• CWE-150

OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

• openwrt
• Cross-site scripting (XSS)
• Other injection

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes

• PETDANCE App::Ack
• CWE-150

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections

• JASEI Net::Statsite::Client
• Other injection
• CWE-150

Kitty vulnerable to command injection via unsanitized OSC 21 query reply

• kovidgoyal kitty
• Code injection
• CWE-150

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections

• PEVANS Metrics::Any::Adapter::SignalFx
• Other injection
• CWE-150

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections

• PEVANS Metrics::Any::Adapter::DogStatsd
• Other injection
• CWE-150

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections

• PEVANS Metrics::Any::Adapter::Statsd
• Other injection
• CWE-150

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags

• BINARY DataDog::DogStatsd
• Other injection
• CWE-150

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections

• BINARY DataDog::DogStatsd
• Other injection
• CWE-150

Etsy::StatsD versions through 1.002002 for Perl allow metric injections

• SANBEG Etsy::StatsD
• Other injection
• CWE-150

Net::Statsd versions before 0.13 for Perl allow metric injections

• COSIMO Net::Statsd
• Other injection
• CWE-150

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections

• TEAM Net::Async::Statsd::Client
• Other injection
• CWE-150

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections

• RRWO Mojolicious::Plugin::Statsd
• Other injection
• CWE-150

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

• CWE-150

>=1.6.0, <=1.14.0 · no fixed version yet

Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks

• jarrodwatts claude-hud
• CWE-150

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections

• RRWO Net::Statsd::Lite
• Other injection
• CWE-150

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

• RRWO Net::Statsd::Tiny
• Other injection
• CWE-150

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections

• RRWO Net::Statsd::Lite
• Other injection
• CWE-150

Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution

• Eugeny tabby
• CWE-150

KDE KCoreAddons: In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments…

• KDE KCoreAddons
• CWE-150

BaseCookie.js_output() does not neutralize embedded characters

• Python Software Foundation CPython
• CWE-150

Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

• CWE-150

<0.49.1 · fixed in 0.49.1

MuPDF < 1.27 mutool ANSI Injection via Metadata

• Artifex Software Inc. MuPDF
• CWE-150

Microsoft Power Apps Desktop Client Spoofing Vulnerability

• Microsoft Power Apps Desktop Client
• CWE-150

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

• CWE-116
• CWE-150

>=2026.2.13, <2026.3.28 · fixed in 2026.3.28

AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

• Other injection
• CWE-20

>=3.11.7, <3.371.4 · fixed in 3.371.4

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

• CWE-150

>=8.0.0-20260105080200-d27a2195068d, <8.0.0-20260217110922-b7d4a1f1f59b || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.2 || >=11.4.0-rc1, <11.4.1 · fixed in 8.0.0-20260217110922-b7d4a1f1f59b, 10.11.11, 11.2.3, 11.3.2, 11.4.1

QuRouter

• QNAP Systems Inc. QuRouter
• CWE-150

Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.

• Tanium Appliance
• CWE-150

Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit

• Other injection
• CWE-150

<1.28.3 · fixed in 1.28.3

Word Copilot Information Disclosure Vulnerability

• Microsoft 365 Word Copilot
• CWE-150

badkeys vulnerable to ASCII control character injection on console via malformed input

• CWE-150

<0.0.16 · fixed in 0.0.16

Apache HTTP Server: CGI environment variable override

• Apache Software Foundation Apache HTTP Server
• CWE-150

Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve

• CWE-150

<0.11.0 · fixed in 0.11.0