CVE-2026-3108

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

Scoring

Severity

HIGH

CVSS base score

8

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS probability

0.28%

CWE

CWE-150

Published

2026-03-26

Last modified

2026-03-27

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-150

Related vulnerabilities

• CVE-2026-82710 — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
• CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
• CVE-2026-19591 — OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS...
• CVE-2026-72847 — broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
• CVE-2026-75483 — powerlevel10k Control Character Injection via package.json Version
• CVE-2026-73506 — Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
• CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD
• CVE-2026-73036 — Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Markdown version · Browse all CVEs