EUVD-2026-76994
GHSA-8gvc-v57h-233c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
AnalysisAI
Terminal escape sequence injection in procs (the Rust-based ps replacement by dalance) through version 0.14.12 enables a local attacker to embed ANSI, CSI, or OSC control sequences in process argv that are rendered unfiltered into other users' terminals when they run procs. The Command column in src/columns/command.rs only stripped literal newlines and tabs, leaving ESC bytes and derived sequences intact; a victim running procs on the same host will have those sequences interpreted by their terminal emulator, enabling clipboard overwrite via OSC 52, screen manipulation via CSI, or hyperlink spoofing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today