Terminal escape sequence injection in the onefetch CLI (through version 2.28.1) lets an attacker who controls a repository's project manifest metadata manipulate the victim's terminal when the victim runs onefetch against that repository. Because the tool writes manifest name and version field values directly to the terminal without neutralizing control characters, embedded ANSI/OSC sequences can rewrite window titles, hide or spoof displayed text, or trigger emulator-specific behavior; the concrete effect depends on the terminal emulator in use. There is no public exploit code identified at time of analysis and no confirmed active exploitation, CVSS is 4.8, and the assessed real-world risk is low-to-medium: the attacker must first get the victim to inspect a repository containing poisoned manifest fields, and exploitation yields display manipulation rather than code execution within onefetch itself.
Terminal escape sequence injection in spaceship-prompt through 4.22.5 allows unauthenticated local attackers to spoof terminal output and manipulate window titles by embedding ANSI/OSC sequences in project manifest version fields when a victim enters a crafted directory. Exploitation requires the victim to have the 'package' section enabled and to navigate into the malicious directory; impact is limited to low integrity of the terminal display with no code execution or data disclosure. No public exploit or active exploitation is known at time of analysis, and the risk is considered low.