EUVD-2026-90576
GHSA-ggwj-h7wp-pg4f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged shell on monitored host
-
DeliveryCraft process with escape sequences in argv[0]
-
Exploitcollectl relays process name to operator's colmux
-
ExecutionUnsanitized data rendered in operator terminal
-
ImpactSpoof display or inject terminal commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Escape character neutralization
|
| Exploitation Conditions | Requires (1) the attacker to already hold an unprivileged local account on a host that is being monitored by a collectl instance; (2) an operator to be running colmux and actively viewing the compromised host's data; and (3) the operator's terminal emulator to interpret the injected ANSI/VT100 escape sequences (many modern emulators disable the most dangerous sequences by default, which limits impact). The injection vector is specifically a crafted process name (argv[0]) relayed in collectl's remote process data. These stacked prerequisites - attacker foothold on a monitored node plus live operator viewing plus a permissive terminal - substantially narrow realistic exploitation despite the network attack vector. |
| Impact | This is a terminal escape-sequence injection flaw (CWE-150) in colmux, the multi-host aggregation front-end of collectl. The vendor CVSS 3.1 vector (7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) is internally defensible but nuanced: AV:N is justified because the malicious data traverses the network from a monitored collectl instance to the operator's colmux session, even though the attacker's foothold is LOCAL on the monitored host (the description explicitly says 'a local user on a monitored host'). AC:H and UI:R correctly capture that exploitation depends on an operator actively running colmux and viewing the attacker-controlled host, AND on the operator's terminal emulator honoring dangerous escape sequences - modern xterm-family terminals disable the most dangerous ones by default. PR:L reflects the need for an unprivileged local account on a monitored node. The C:H/I:H with S:C rating is optimistic but reasonable: terminal escape injection can rewrite screen content, spoof output, and in some emulator/shell combinations chain to command execution in the operator's session, which is a higher-privilege context (hence scope change). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis; no SSVC decision data was supplied. Net: a legitimately high CVSS driven by scope change and the privileged victim context, but real-world risk is tempered by the multi-condition gate (attacker already on a monitored host, operator live-viewing that host, and a permissive terminal). Treat as a moderate, contingent risk rather than a drop-everything priority. |
| Exploit ScenarioDerived | An attacker with an unprivileged shell on a host being monitored by collectl launches (or renames) a process whose argv[0] embeds crafted ANSI/VT100 escape sequences. When an operator runs colmux to aggregate that host's process data, colmux renders the process name verbatim into the operator's terminal, letting the attacker falsify the display or, depending on the operator's terminal emulator, attempt to inject commands into the operator's session. No public exploit code is identified at time of analysis, but the technique is well-documented and the payload is trivial to craft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Terminal escape-sequence injection in colmux, the multi-host aggregation front-end shipped with collectl before 4.3.20.2, lets an attacker who already holds an unprivileged local account on a monitored host embed crafted ANSI/VT100 control sequences - delivered via a fake process name (argv[0]) in the host's collected process data - into the terminal of an operator running colmux and viewing that host. Because colmux renders remote data without neutralizing escape, meta, or control characters (CWE-150), the injected sequences can rewrite displayed output or invoke terminal-emulator features, giving high integrity and confidentiality impact on the operator's session (CVSS 3.1 7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Exploitation is constrained by stacked prerequisites: attacker foothold on a monitored node, an operator actively viewing that host in colmux, and a terminal emulator that still honors the more dangerous escape sequences, which many modern emulators disable by default; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
RemediationAI
Vendor-released patch: collectl 4.3.20.2 - upgrade collectl (and therefore colmux) on every operator workstation and any host that runs colmux to 4.3.20.2 or later; Fedora users should install the updated collectl package once the distribution errata for CVE-2026-103431 lands, and track https://access.redhat.com/security/cve/CVE-2026-103431 plus https://bugzilla.redhat.com/show_bug.cgi?id=2543974 for backported fixes on Red Hat-based platforms. If immediate upgrade is not possible, the practical compensating controls are: run colmux only inside a hardened terminal emulator that disables the risky escape sequences (for xterm-family emulators, turn off window/OSC operations such as allowWindowOps, and prefer emulators that sandbox or ignore title-clipboard-window manipulation sequences) - trade-off is that some legitimate colmux screen formatting may render differently; pipe collected output through a control-character filter before display (for example, wrap the colmux invocation so remote streams are passed through a cat -v/sed-style escape-stripping filter) - trade-off is added latency and possible corruption of legitimate colored output; restrict colmux to monitoring only hosts and accounts you fully trust, treating any host where unprivileged users can set argv[0] as an injection source - trade-off is reduced monitoring coverage; and never run colmux from a privileged account or inside a session where terminal escape sequences can reach a shell prompt or clipboard, since the same sequences that rewrite display output can also plant commands or exfiltrate data into the operator's session. Because there is no public exploit code identified at time of analysis and the flaw is not in CISA KEV, prioritization can follow normal patch cycles, but operator-facing terminals should be protected as soon as the 4.3.20.2 package is available.
Affected ProductsAI
collectl versions prior to 4.3.20.2 are affected, specifically the colmux utility bundled with collectl; the fix is contained in collectl 4.3.20.2, so any collectl release older than 4.3.20.2 that includes colmux should be considered vulnerable. No CPE entries were supplied with this report, so exact package-to-CPE mapping is not independently confirmed; the reporting source is Fedora, meaning Fedora-packaged collectl (and any downstream distribution shipping the upstream tarball below 4.3.20.2, such as EPEL or Red Hat-based rebuilds) may ship the affected colmux. Vendor-tracked details, including any distribution-specific version ranges and package errata, are documented at https://access.redhat.com/security/cve/CVE-2026-103431 and in the associated Red Hat Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2543974. Note that the vulnerability concerns the colmux aggregation/display side, so hosts running only the collectl data collector without a colmux operator are not the direct target of the injection.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
collectl is a Linux performance-monitoring tool that gathers CPU, disk, network, and process statistics; colmux is its curses-style multiplexer that connects to multiple remote collectl instances and displays their streams side by side in a single terminal. Remote process data includes the process command line and argv[0], which is attacker-controllable on any host the attacker can run code on. The root cause is CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences): colmux passes that remote text to the terminal without stripping or escaping ANSI/VT100 control sequences, so an embedded ESC sequence is interpreted by the operator's terminal emulator rather than printed literally. This class of flaw is inherently a confused-deputy/data-to-terminal problem - the operator's terminal becomes the injection target while the attacker's position is only that of a data producer on a monitored node. The CVSS vector (AV:N because the payload traverses the network from a remote collectl instance, AC:H and UI:R because the operator must be running colmux and looking at the affected host's output, PR:L because the attacker needs a local account on the monitored host, S:C because the terminal session is a different security authority than the compromised host, C:H/I:H with A:N because the effect is terminal-mediated data disclosure/manipulation rather than process compromise) accurately reflects these layered conditions. The Red Hat bug (Bugzilla 2543974) and Red Hat CVE page are the primary vendor-tracked references; the report originated from Fedora packaging, so Fedora users should follow the Fedora update stream for the patched collectl build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Malicious data crosses the network to the operator (AV:N), but needs a local account on a monitored host (PR:L), live operator viewing (UI:R), and a permissive terminal (AC:H); escape injection affects the operator's session beyond colmux (S:C).
Primary rating from Vendor (fedora).
CVSS VectorVendor: fedora
DescriptionCVE.org
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).
Articles & Coverage 1
Executive ViewAI
A high-severity flaw in collectl's colmux terminal aggregation tool (CVE-2026-103431) allows a low-privileged local attacker on a monitored host to inject terminal escape sequences into the session of an operator viewing that host, potentially corrupting displayed monitoring data and exposing sensitive session information. This requires an authenticated local foothold and operator interaction, but successful exploitation undermines operator trust and the integrity of multi-host monitoring. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; leadership should prioritize interim mitigations while awaiting a fix.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting colmux access to trusted operators, configuring terminal emulators to disable or filter ANSI/VT100 escape sequences and other control characters, sanitizing or normalizing process names in collected data, limiting local unprivileged accounts on monitored hosts, and monitoring for suspicious argv[0] values. If collectl 4.3.20.2 becomes available, apply it immediately.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB