Usage Rules
Monthly
Terminal escape sequence injection in ash-project/usage_rules (versions 0.1.18 through 1.2.7) allows a malicious Hex package publisher to forge what developers see when running mix usage_rules.search_docs. The Mix task queries search.hexdocs.pm and renders publisher-controlled fields - title, package name, type, doc reference, and highlighted snippets - verbatim to the terminal with no control-character sanitization, only adding ANSI highlighting rather than stripping injected sequences. A package author who embeds ANSI cursor-movement, line-erase, carriage-return, or OSC 52 clipboard-write sequences in their documentation can cause a developer's terminal to display a forged hexdocs URL, conceal output, or silently write an attacker-controlled command to the clipboard; no public exploit has been identified at time of analysis.
Terminal escape sequence injection in ash-project/usage_rules (versions 0.1.18 through 1.2.7) allows a malicious Hex package publisher to forge what developers see when running mix usage_rules.search_docs. The Mix task queries search.hexdocs.pm and renders publisher-controlled fields - title, package name, type, doc reference, and highlighted snippets - verbatim to the terminal with no control-character sanitization, only adding ANSI highlighting rather than stripping injected sequences. A package author who embeds ANSI cursor-movement, line-erase, carriage-return, or OSC 52 clipboard-write sequences in their documentation can cause a developer's terminal to display a forged hexdocs URL, conceal output, or silently write an attacker-controlled command to the clipboard; no public exploit has been identified at time of analysis.