onefetch CVE-2026-100866

Exploitation requires the victim to run the onefetch CLI (version through 2.28.1) against a repository whose project manifest name or version fields have been populated with attacker-supplied ANSI/OSC terminal escape sequences; the attacker must therefore control the manifest contents of a repo the victim inspects. Impact is limited by the local attack vector (victim must execute the tool), the required user interaction, and the terminal emulator's own handling of escape sequences - the concrete effect (title rewrite, hidden/spoofed text, emulator-specific behavior) varies by terminal and there is no code execution within onefetch itself.

This is a genuinely low-to-medium real-world risk despite being a valid injection flaw. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 4.8 (medium) and is internally consistent with the description: exploitation is local (the victim must run onefetch against attacker-controlled repository data), requires passive user interaction, and yields only limited integrity impact (VI:L) with no confidentiality or availability loss. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict: a local vector plus required user interaction plus integrity-only impact all point to a low-severity, opportunistic issue rather than a mass-exploitation priority. The only mild tension is the 'Code Injection' tag, which overstates the flaw - CWE-150 (improper neutralization of escape/meta characters) describes terminal escape-sequence injection, not arbitrary code execution in onefetch itself. Note that terminal-escape injection can occasionally escalate on specific emulators (window-title rewrite, clipboard/paste tricks), which is why residual risk is not zero, but the vendor conservatively rated integrity as Low.

An attacker publishes or contributes a Git repository whose project manifest (e.g. name or version field) contains embedded ANSI/OSC escape sequences. When a victim clones the repo and runs onefetch (2.28.1 or earlier) to display its summary, onefetch writes those field values to the terminal without stripping control characters, letting the attacker rewrite the window title, hide or spoof text, or trigger emulator-specific behavior. No public exploit code has been identified, and success depends on the victim voluntarily running the tool against the malicious repository.