CVE-2026-50642

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized. An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences. Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking. This issue has been fixed in the commit 9c81294

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/07/CVE-2026-41874/
https://github.com/so-fancy/diff-so-fancy

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) diff?so?fancy no sanitiza correctamente las secuencias de control de terminal no SGR antes de mostrar los datos diff. La aplicación solo elimina las secuencias ANSI SGR mientras permite que otros caracteres de control, incluyendo el retorno de carro (\r) y las secuencias de escape (p. ej., OSC, CSI), pasen sin sanitizar. Un atacante puede incrustar secuencias de control maliciosas en nombres de archivo, metadatos diff o contenido de archivo que se renderizan directamente en el terminal durante la visualización del diff. Esto puede llevar a la manipulación de la salida, incluyendo la suplantación de nombres de archivo, el borrado de la pantalla del terminal y la inyección en el portapapeles a través de secuencias de escape soportadas. La explotación exitosa puede inducir a error a los usuarios durante la revisión de código, alterar el estado del terminal o resultar en la ejecución de comandos no deseados mediante el secuestro del portapapeles. Este problema ha sido corregido en el commit 9c81294

Information

Published : 2026-07-29 11:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-50642

Mitre link : CVE-2026-50642

CVE.ORG link : CVE-2026-50642

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-50642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T12:13:35.752261Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/so-fancy/diff-so-fancy", "vendor": "so-fancy", "product": "diff-so-fancy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.10"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-29T11:16:49.617", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41874/", "source": "cvd@cert.pl"}, {"url": "https://github.com/so-fancy/diff-so-fancy", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.\n\nAn attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.\n\nSuccessful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.\n\nThis issue has been fixed in the commit\u00a09c81294"}, {"lang": "es", "value": "diff?so?fancy no sanitiza correctamente las secuencias de control de terminal no SGR antes de mostrar los datos diff. La aplicaci\u00f3n solo elimina las secuencias ANSI SGR mientras permite que otros caracteres de control, incluyendo el retorno de carro (\\r) y las secuencias de escape (p. ej., OSC, CSI), pasen sin sanitizar.\n\nUn atacante puede incrustar secuencias de control maliciosas en nombres de archivo, metadatos diff o contenido de archivo que se renderizan directamente en el terminal durante la visualizaci\u00f3n del diff. Esto puede llevar a la manipulaci\u00f3n de la salida, incluyendo la suplantaci\u00f3n de nombres de archivo, el borrado de la pantalla del terminal y la inyecci\u00f3n en el portapapeles a trav\u00e9s de secuencias de escape soportadas.\n\nLa explotaci\u00f3n exitosa puede inducir a error a los usuarios durante la revisi\u00f3n de c\u00f3digo, alterar el estado del terminal o resultar en la ejecuci\u00f3n de comandos no deseados mediante el secuestro del portapapeles.\n\nEste problema ha sido corregido en el commit 9c81294"}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "cvd@cert.pl"}