EUVD-2026-56901
GHSA-4c3c-r6p8-c863
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker supplies malicious files remotely (AV:N, PR:N); no special conditions required (AC:L); integrity of scan output is wholly compromised (I:H); no confidentiality or availability impact.
Primary rating from Vendor (https://github.com/david-a-wheeler/flawfinder).
CVSS VectorVendor: https://github.com/david-a-wheeler/flawfinder
Lifecycle Timeline
5Blast Radius
ecosystem impact- 11 pypi packages depend on flawfinder (3 direct, 8 indirect)
Ecosystem-wide dependent count for version 2.0.20.
DescriptionCVE.org
Impact
This vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection:
- Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. For example, this might allow an attacker to hide critical scan results, falsely making it appear to a human reviewer that no security issues were found.
- CSV and XML Injection: Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar().
It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents.
The initial filename injection problem was reported by Dan Lenz https://www.linkedin.com/in/dan-lenz/
The other vulnerabilities were found by flawfinder project leader David A. Wheeler, GitHub david-a-wheeler, https://dwheeler.com/
Patches
This issue has been fully patched in Version 2.0.20 (released 2026-05-16). All users should upgrade to version 2.0.20 or later immediately. If you use Python's package manager, you can upgrade using pip install --upgrade flawfinder. If you are consuming flawfinder via GitHub Actions, ensure your workflow points to david-a-wheeler/flawfinder@2.0.20 or later.
Workarounds
There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by:
- Pre-scanning filenames: Manually or programmatically verifying that target repositories do not contain filenames with control characters (including ANSI escape sequences) before passing them to flawfinder.
- Inspecting raw output: Reviewing flawfinder outputs in a text editor or logging mechanism that explicitly displays or strips raw escape sequences, rather than relying on live terminal rendering.
- Restricting untrusted inputs: Avoiding the generation of SonarQube or CSV reports from completely untrusted repositories until the tool is updated.
Resources
See the flawfinder GitHub Repository: https://github.com/david-a-wheeler/flawfinder
AnalysisAI
Output manipulation in flawfinder, the Python-based C/C++ source code security scanner, allows attackers who control scanned filenames or file contents to inject ANSI escape sequences into terminal output and arbitrary content into structured CSV and SonarQube XML reports. Versions prior to 2.0.20 fail to neutralize untrusted fields - including filenames, categories, and code context text - before including them in tool output, enabling an adversary to hide critical security findings from human reviewers or corrupt downstream report processing. Vendor-released patch 2.0.20 (2026-05-16) is available; no KEV listing or confirmed public exploit code has been identified at time of analysis, though the GHSA advisory is public and the exploitation mechanism is straightforward to replicate.
Technical ContextAI
Flawfinder (pip package: flawfinder, CPE: pkg:pip/flawfinder) is a static analysis tool that scans C and C++ source code for common security weaknesses. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which manifests in two forms: (1) ANSI/terminal escape sequence injection, where filenames containing control characters pass through to standard terminal output without stripping or escaping, enabling an adversary to issue terminal control codes that reposition the cursor, overwrite output lines, or clear the screen; (2) CSV and XML injection in structured report generation, specifically the output_sonar() function, where untrusted fields such as filenames, finding categories, and source code context are interpolated into XML attribute values without encoding, allowing injection of arbitrary XML attributes or structure into SonarQube-formatted reports. Both attack surfaces share the same underlying failure: user-controlled data is treated as safe output content rather than being sanitized or encoded for its output context.
RemediationAI
Upgrade to flawfinder 2.0.20 or later immediately using pip install --upgrade flawfinder; this is the only fully effective fix per the vendor advisory (https://github.com/david-a-wheeler/flawfinder/security/advisories/GHSA-4c3c-r6p8-c863). For GitHub Actions consumers, update workflow references to david-a-wheeler/flawfinder@2.0.20 or a later tag. If an immediate upgrade is not possible, three compensating controls are available, each with trade-offs: (1) Pre-scan filenames programmatically to reject any containing control characters (ASCII < 0x20 or ESC sequences) before passing the repository to flawfinder - this blocks the ANSI injection vector but requires building and maintaining a validation script; (2) Review flawfinder terminal output in a text editor or logging pipeline that renders raw bytes rather than interpreting ANSI codes (e.g., cat -v, less -R disabled, or piping to a log file) - this reveals injection attempts but changes the reviewer workflow; (3) Disable SonarQube and CSV report generation when scanning untrusted repositories - this eliminates the structured-output injection vectors but removes report integration with downstream tooling. None of these workarounds are available as configuration flags within flawfinder itself.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Share
External POC / Exploit Code
Leaving vuln.today