Igniter
Monthly
Terminal escape sequence injection in ash-project Igniter (versions 0.8.1-0.8.3) allows a malicious or typosquatted hex.pm package publisher to forge the `mix igniter.install` confirmation panel by embedding ANSI cursor-movement and line-erase control sequences in publisher-controlled metadata fields such as the package description, owner usernames, version, and download counts. Developers relying on this panel as an anti-typosquatting safeguard are shown attacker-crafted content that conceals the real metadata, potentially deceiving them into approving a malicious dependency. A vendor patch is available in version 0.8.4; no public exploit and no CISA KEV listing have been identified at time of analysis.
Terminal escape sequence injection in ash-project Igniter (versions 0.8.1-0.8.3) allows a malicious or typosquatted hex.pm package publisher to forge the `mix igniter.install` confirmation panel by embedding ANSI cursor-movement and line-erase control sequences in publisher-controlled metadata fields such as the package description, owner usernames, version, and download counts. Developers relying on this panel as an anti-typosquatting safeguard are shown attacker-crafted content that conceals the real metadata, potentially deceiving them into approving a malicious dependency. A vendor patch is available in version 0.8.4; no public exploit and no CISA KEV listing have been identified at time of analysis.