CVE-2020-26283CWE-116

Control character injection in console output

Medium · published March 24, 2021

CVSS v3.1
6.8
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01501 · 74.1th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2021-03-24T20:30Z
EPSS history
Timeline
  • 24 MAR 20:30Z
    Control character injection in console output
    cvelistv5