CVE-2026-73035

Published: Aug 10, 2026Modified: Aug 11, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

Related CWEs

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (4)

https://github.com/raineorshine/npm-check-updates/commit/b554b84848fc0b08a9d2b3d3db15e351387168cf

Source: disclosure@vulncheck.com

https://github.com/raineorshine/npm-check-updates/issues/1988

Source: disclosure@vulncheck.com

https://github.com/raineorshine/npm-check-updates/pull/1994

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/npm-check-updates-terminal-injection-via-unsanitized-escape-sequences

Source: disclosure@vulncheck.com

Timeline

No history available yet.