Все уязвимости

Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

BaseCookie.js_output() does not neutralize embedded characters

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they

MuPDF < 1.27 mutool ANSI Injection via Metadata

Microsoft Power Apps Desktop Client Spoofing Vulnerability

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections

Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

Terminal escape sequence injection in Hex via unneutralized server-supplied output

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequence

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

onefetch through 2.28.1 Terminal Escape Sequence Injection

spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

procs through 0.14.12 Terminal Escape Sequence Injection via Command

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Jinja has a sandbox breakout through malicious filenames

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified

powerlevel10k Control Character Injection via package.json Version

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences