EUVD-2026-50278
GHSA-q6jf-93cp-9xwf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because attacker controls repository content, not network path; scope change because clipboard and terminal state are outside the application boundary.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.
An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.
Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.
This issue has been fixed in the commit 9c81294
AnalysisAI
Terminal control sequence injection in diff-so-fancy exposes developers to output manipulation, filename spoofing, terminal screen clearing, and clipboard hijacking when viewing diffs containing attacker-controlled content. The application filters only ANSI SGR sequences while passing OSC, CSI, carriage returns, and other VT100 control characters through unsanitized to the terminal, affecting all versions prior to commit 9c81294. No public exploit is identified at time of analysis, but the low attack complexity (CVSS 4.0 AV:L/AC:L) means the primary barrier is only the requirement for a developer to actively view the malicious diff.
Technical ContextAI
diff-so-fancy (CPE: cpe:2.3:a:so-fancy:diff-so-fancy:*:*:*:*:*:*:*:*) is a Node.js-based git diff beautifier that post-processes output from git diff, applying color and formatting improvements. Its sanitization logic targets ANSI SGR (Select Graphic Rendition) sequences - the codes that set text color and style - but ignores the broader ANSI/VT100 escape sequence taxonomy. This includes OSC (Operating System Command, e.g., sequences used to set clipboard content on xterm-compatible terminals via OSC 52), CSI (Control Sequence Introducer, enabling cursor movement and screen clearing), and bare carriage returns (\r) that allow line overwriting. CWE-116 (Improper Encoding or Escaping of Output) precisely describes this root cause: the application performs output encoding for a subset of dangerous characters while leaving a larger attack surface unsanitized. Attack surface includes git-tracked filenames, commit metadata, and file contents - all of which appear in diff output.
RemediationAI
The upstream fix is available via commit 9c81294 in the diff-so-fancy GitHub repository (https://github.com/so-fancy/diff-so-fancy); however, no tagged release version has been confirmed from the available data, so users should update directly from the latest HEAD of the main branch or monitor the repository for a formal release. As a compensating control, developers can pipe diff-so-fancy output through a terminal sequence stripping tool such as ansi2txt or strip-ansi before display, though this will remove intended color formatting. Alternatively, switching to a diff viewer with comprehensive escape sequence sanitization (e.g., delta) removes the vulnerable component entirely. Developers reviewing untrusted contributions should be especially cautious and consider inspecting raw git diff output directly when evaluating external pull requests until an official patched release is available.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today