CVE-2026-103431

Published: Oct 1, 2026Modified: Oct 1, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Exploitability: 1.3 / Impact: 5.8

Source: patrick@puiterwijk.org (Secondary)

Description

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).

Related CWEs

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (2)

https://access.redhat.com/security/cve/CVE-2026-103431

Source: patrick@puiterwijk.org

https://bugzilla.redhat.com/show_bug.cgi?id=2543974

Source: patrick@puiterwijk.org

Timeline

No history available yet.