CVE-2026-73035Medium· 4.3▾ Sunlitnpm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75483Low· 3.3powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment
CVE-2026-73036Medium· 4.4Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in …
CVE-2026-72847Medium· 4.6broot renders each file and directory name in its interactive tree view exactly as read from the filesystem
CVE-2026-93421Medium· 5.3Mesop is a Python-based UI framework that allows users to build web applications
CVE-2026-90773Low· 3.2procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column
CVE-2026-90895High· 8.4Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web applicat…