CVE-2026-73035
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.21%
- CWE
- CWE-150
- Published
- 2026-08-10
- Last modified
- 2026-08-11
Affected products
- raineorshine npm-check-updates
- raineorshine npm-check-updates
Weakness type
Related vulnerabilities
- CVE-2026-82710 — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
- CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-19591 — OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS...
- CVE-2026-72847 — broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
- CVE-2026-75483 — powerlevel10k Control Character Injection via package.json Version
- CVE-2026-73506 — Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
- CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD
- CVE-2026-73036 — Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml