EUVD-2026-16234
GHSA-3439-vqgj-2gcf
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599
AnalysisAI
Mattermost's mmctl command-line administration tool fails to sanitize ANSI and OSC escape sequences embedded in user-generated post content, enabling authenticated low-privilege attackers to inject malicious terminal control codes when administrators export or query messages. Exploitation allows screen manipulation, fake prompt injection, and clipboard hijacking against administrators running mmctl commands, potentially leading to secondary code execution if administrators are tricked into running injected commands. CISA SSVC framework indicates no current exploitation, non-automatable attack requiring high complexity and user interaction, but with total technical impact potential.
Technical ContextAI
This vulnerability affects the mmctl command-line tool within Mattermost server deployments (CPE: cpe:2.3:a:mattermost:mattermost). The root cause is CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences), where mmctl fails to strip or encode ANSI escape sequences (used for terminal formatting like colors and cursor positioning) and OSC (Operating System Command) sequences when rendering post content to administrator terminals. When mmctl retrieves message data containing attacker-crafted escape sequences, these codes are passed directly to the terminal emulator, which interprets them as legitimate control commands rather than display text. This allows attackers to manipulate the visual output of the terminal, insert fake command prompts that appear legitimate, or use OSC 52 sequences to read/write clipboard contents on certain terminal emulators.
RemediationAI
Upgrade to Mattermost versions beyond 11.4.0, 11.3.1, 11.2.2, or 10.11.10 respectively for each affected branch once patched releases become available per vendor advisory at https://mattermost.com/security-updates. Until patching is completed, administrators should exercise caution when using mmctl to query or export post content from channels accessible to untrusted users, avoid copying terminal output directly into clipboard or executing commands suggested by terminal prompts without verification, and consider using mmctl in isolated environments with output redirected to files for sanitized review. Organizations may implement wrapper scripts that filter ANSI/OSC sequences from mmctl output using tools like sed or ansi2txt before display. Review administrator workflows to minimize mmctl usage against user-generated content channels and restrict mmctl access to trusted operators only.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allVendor StatusVendor
Debian
Bug #823556| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today