Ember TUI CVE-2026-54162
MEDIUM
GHSA-x3g7-qrwc-f6c5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
AV:N because the trigger is an HTTP request to Caddy; PR:N since no credentials are needed; UI:R because the operator must render the Logs tab; S:C for cross-boundary terminal/clipboard impact; I:L for limited integrity effect with no confidentiality or availability loss.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs - most notably the request URI - straight to the operator's terminal without neutralising terminal escape or control sequences (CWE-150). Those log fields are populated from arbitrary, unauthenticated HTTP requests, so any remote client can embed ANSI/OSC/CSI control bytes that the operator's terminal emulator interprets when the log row is displayed. The bytes survive the whole pipeline: Caddy escapes them into its JSON access log as unicode escapes, ember's ParseLogLine decodes them back to raw 0x1b/0x07 bytes, and the row formatters concatenate them into the bubbletea View() output with no encoding before they reach os.Stdout.
Impact
An unauthenticated, remote attacker who can send HTTP requests to the Caddy server that ember monitors can inject terminal escape sequences into the operator's TUI. The trigger is a single ordinary HTTP request with control bytes in the request target. It requires no authentication; because the payload is reflected through Caddy's normal access log, it works even when ember's log listener is bound only to loopback. When the operator views the Logs tab - ember's default, zero-config mode - the terminal emulator interprets the injected sequences. Broadly-supported, demonstrated impact includes:
- Monitoring-dashboard spoofing - CSI cursor/erase/scroll sequences forge or hide log rows so the operator misjudges the monitored server's state.
- Clipboard hijacking (OSC 52) - attacker-chosen text is written into the operator's system clipboard, staging a payload the operator may later paste into a shell.
- Window-title spoofing (OSC 0/2) - to support social engineering.
The impact ceiling depends on the operator's terminal emulator and usually requires a further operator action (e.g. a paste) to fully escalate; this is not general-case RCE, though specific terminal emulators have historically escalated escape sequences further. The Certificates and Routes tabs share the same unneutralised render path as secondary sinks. The --json/--once and daemon (--expose) modes are not affected, as they do not render to an interactive terminal.
References
- https://github.com/alexandre-daubois/ember/blob/main/internal/ui/logtable.go#L18 - the unneutralised render helper (
fitCellLeft) and row formatters (the sink) - https://github.com/alexandre-daubois/ember/blob/main/internal/fetcher/lognetlistener.go - the unauthenticated TCP access-log listener (input source)
- https://github.com/alexandre-daubois/ember/blob/main/internal/fetcher/logentry.go -
ParseLogLine, where the JSON decode restores raw control bytes - https://cwe.mitre.org/data/definitions/150.html - CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
AnalysisAI
Terminal escape sequence injection in Ember's interactive TUI allows unauthenticated remote attackers to smuggle ANSI/OSC/CSI control bytes into an operator's terminal by embedding them in HTTP requests sent to the monitored Caddy server. Ember's ParseLogLine restores raw control bytes from Caddy's unicode-escaped JSON access log, and the render helpers fitCellLeft and fitCellRight pass them unfiltered to os.Stdout via bubbletea's View(), enabling clipboard hijacking (OSC 52), dashboard spoofing (CSI cursor/erase), and window-title manipulation (OSC 0/2). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to send HTTP requests to the specific Caddy server instance that Ember is configured to monitor - this is the sole prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) accurately reflects a network-reachable, unauthenticated path with a genuine scope change but limited direct impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Ember to version 1.4.2 or later (https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2), which is confirmed by the GitHub Advisory GHSA-x3g7-qrwc-f6c5 and patch commit fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today