CVE-2026-3108CWE-150

Terminal Escape Injection in mmctl Report Posts Command

High · published March 26, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published
2026-03-26T16:16Z
EPSS history
Timeline
  • 26 MAR 16:16Z
    Terminal Escape Injection in mmctl Report Posts Command
    cvelistv5