npm-check-updates EUVD-2026-55804

Exploitation requires all three of the following conditions: (1) the developer or CI pipeline explicitly invokes npm-check-updates with the --format homepage or --format repo flag - these are non-default options absent from a standard ncu run; (2) at least one dependency in the project's scope has attacker-controlled escape sequences embedded in its homepage, repository, engines.node, or peer dependency metadata fields in package.json; and (3) the installed npm-check-updates version is 23.0.2 or earlier. The injection code paths for peer dependency reason strings and engine constraints are additionally gated on ncu detecting unresolvable conflicts or version mismatches for those packages. Exploitation is limited to terminal output manipulation on the invoking user's workstation or CI runner session and does not enable remote code execution, privilege escalation, or data exfiltration. Production servers running npm-check-updates are not a typical deployment target and are unlikely to be affected.

The CVSS 4.0 score of 5.3 (Medium) is broadly appropriate but may overstate complexity: the provided vector AV:N/AC:L/AT:N/PR:N/UI:P reflects that attack complexity is assessed as low, though exploitation in practice requires a developer to explicitly invoke two non-default flags (--format homepage or --format repo) while also having a malicious package in their dependency tree - conditions that together reduce realistic exploitation probability. There is no EPSS data provided; exploitation likelihood is inferred from the CVSS vector and the non-default flag requirement. No CISA KEV listing exists and no confirmed in-the-wild exploitation has been reported. The impact is strictly limited to terminal output manipulation (VI:L, VC/VA/SC/SI/SA all N), meaning this cannot achieve code execution, credential theft, or availability disruption through this vector alone. This is a developer-tooling supply-chain vector targeting workstations and CI environments, not production servers. Real-world priority is low for most organizations unless CI pipelines explicitly use the affected format flags against untrusted package sources.

A threat actor publishes a malicious npm package to the public registry and embeds an OSC terminal escape sequence such as \x1b]0;pwned\x07 in the homepage field of its package.json, or a bare carriage return (\r) in the repository field to overwrite a rendered URL with attacker-controlled text. When a developer auditing dependency updates runs ncu --format homepage on a project that lists this package as a dependency, npm-check-updates reads the metadata, interpolates it unfiltered into the terminal table, and the escape sequence executes in the developer's terminal - setting the window title to attacker-controlled text or making a malicious URL appear to display as a legitimate one. No public exploit code exists beyond the fix PR's test cases, which demonstrate the attack precisely.