broot CVE-2026-72847

The attacker must have low-privilege local write access to any directory on the filesystem (PR:L) - no special broot configuration, feature flag, or elevated permission is required. Exploitation requires a victim to actively browse the directory containing the malicious filename using broot (UI:P); simply having broot installed is not sufficient. The exploit path is broot's primary function (tree browsing), meaning no obscure or non-default mode is needed. The key limiting factor is the terminal emulator in use: the injected sequence must be interpreted by the terminal for any meaningful impact - terminals that ignore unsupported OSC/CSI sequences will exhibit no effect beyond displaying the U+FFFD replacement character (or similar) after patching. Clipboard hijacking via OSC 52 specifically requires the terminal emulator to support and honor that sequence (e.g., xterm with allowWindowOps, some VTE-based terminals). Attack is constrained to local system access; no network vector exists.

The official CVSS 4.0 score of 2.4 accurately reflects the limited realistic impact: the attack is strictly local (AV:L), requires only low-privilege filesystem write access (PR:L), and demands passive victim interaction (UI:P - someone must browse the directory with broot). No EPSS data is provided in available intelligence; the vulnerability is not listed in CISA KEV. A proof of concept exists as documented in the CVE description and the GitHub issue. The VC:L/VI:L downstream-system impacts (SC:L/SI:L) capture the realistic terminal-emulator-dependent consequences - clipboard hijacking via OSC 52 is confirmed by the POC, but broader impact (e.g., executing arbitrary terminal commands via CSI sequences) depends entirely on the terminal emulator's feature set and security posture. The primary real-world risk scenario is multi-user shared Linux or container environments where different-privilege users share writable directories and independently run broot. Single-user workstations where the attacker already has local access present negligible additional risk beyond what the attacker already possesses.

On a multi-user Linux system, an unprivileged attacker creates a file named with an embedded OSC 52 sequence such as $'\x1b]52;c;base64encodedpayload\x07legit_filename.txt' in a shared directory. When a targeted user (e.g., a system administrator) browses that directory with broot, broot renders the filename verbatim to their terminal, causing their terminal emulator to execute the OSC 52 command and overwrite their clipboard with attacker-controlled content. A proof of concept confirming the OSC 52 sequence reaches the terminal unstripped has been reported in the GitHub issue tracker.