CVE-2026-100867
MEDIUM
4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none
Description
AI Translation Available
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.
150
Improper Neutralization of Escape, Meta, or Control Sequences
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Execute Unauthorized Code Or Commands
Hide Activities
Unexpected State
Applicable Platforms
Technologies:
AI/ML
https://github.com/spaceship-prompt/spaceship-prompt
https://github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498e…
https://github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498e…
https://github.com/spaceship-prompt/spaceship-prompt/issues/1567
https://www.vulncheck.com/advisories/spaceship-prompt-through-4.22.5-terminal-e…