CVE-2026-100866Low· 3.3▾ Sunlitonefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest versio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100867Low· 3.3spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt
CVE-2026-26149Critical· 9.0Microsoft Power Apps Desktop Client Spoofing Vulnerability
CVE-2026-72847Medium· 4.6broot renders each file and directory name in its interactive tree view exactly as read from the filesystem
CVE-2026-93421Medium· 5.3Mesop is a Python-based UI framework that allows users to build web applications
CVE-2026-90773Low· 3.2procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column
CVE-2026-90895High· 8.4Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web applicat…