CVE-2026-100866CWE-150

CVE-2026-100866

Low · published September 27, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00128 · 2.2th percentile
Weakness
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published
2026-09-27T17:16Z
References (5)
https://github.com/o2sh/onefetch · [email protected]https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/utils/info_field.rs#L43-L55 · [email protected]https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/version.rs#L33-L35 · [email protected]https://github.com/o2sh/onefetch/issues/1828 · [email protected]https://www.vulncheck.com/advisories/onefetch-through-2.28.1-terminal-escape-sequence-injection · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:09Z
    onefetch through 2.28.1 Terminal Escape Sequence Injection
    cvelistv5