Procs
Monthly
Terminal escape sequence injection in procs (the Rust-based `ps` replacement by dalance) through version 0.14.12 enables a local attacker to embed ANSI, CSI, or OSC control sequences in process argv that are rendered unfiltered into other users' terminals when they run procs. The Command column in `src/columns/command.rs` only stripped literal newlines and tabs, leaving ESC bytes and derived sequences intact; a victim running procs on the same host will have those sequences interpreted by their terminal emulator, enabling clipboard overwrite via OSC 52, screen manipulation via CSI, or hyperlink spoofing. No public exploit exists beyond the fix-commit unit test, and the CVSS 4.0 score of 2.4 (Low) accurately reflects the narrow, local-only, limited-integrity impact.
Terminal escape sequence injection in procs (the Rust-based `ps` replacement by dalance) through version 0.14.12 enables a local attacker to embed ANSI, CSI, or OSC control sequences in process argv that are rendered unfiltered into other users' terminals when they run procs. The Command column in `src/columns/command.rs` only stripped literal newlines and tabs, leaving ESC bytes and derived sequences intact; a victim running procs on the same host will have those sequences interpreted by their terminal emulator, enabling clipboard overwrite via OSC 52, screen manipulation via CSI, or hyperlink spoofing. No public exploit exists beyond the fix-commit unit test, and the CVSS 4.0 score of 2.4 (Low) accurately reflects the narrow, local-only, limited-integrity impact.