---
id: CVE-2026-49864
title: wetty provides terminal access in browser over http/https
summary: >-
  wetty provides terminal access in browser over http/https. Prior to version
  3.0.4, the wetty client decodes a base64 filename from the file-download
  escape sequence and interpolates it raw into a Toastify HTML string
  (`escapeMarkup: fals…
severity: high
cwe:
  - CWE-79
vendor: wetty
product: wetty
affected:
  - wetty < 3.0.4
patched:
  - wetty 3.0.4
published: '2026-08-13'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49864'
references:
  - url: 'https://github.com/butlerx/wetty/security/advisories/GHSA-p26j-h7wj-r568'
    label: security-advisories@github.com
  - url: 'https://github.com/butlerx/wetty/security/advisories/GHSA-p26j-h7wj-r568'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-p26j-h7wj-r568'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00444
epssPercentile: 0.35857
ecosystem: npm
ingestedAt: '2026-07-01T19:15:59.920Z'
---

## Overview

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49864)

Affected packages:

- `wetty < 3.0.4`

Patched in:

- `wetty 3.0.4`

Source: https://github.com/advisories/GHSA-p26j-h7wj-r568