CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/08/CVE-2026-66484
https://git.savannah.gnu.org/cgit/cpio.git

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) GNU cpio es vulnerable a la codificación o escape de salida incorrectos en su funcionalidad de listado de miembros de archivo. Al listar miembros de archivo a través de cpio -it, los nombres de los miembros se imprimen directamente a la salida sin comillas ni escape. Un atacante puede crear un archivo cpio que contenga nombres de miembros con caracteres de nueva línea incrustados o secuencias de escape ANSI, causando entradas de listado falsificadas o inyección de secuencias de control de terminal cuando se muestra el listado. Este problema ha sido corregido en el commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

Information

Published : 2026-08-10 11:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-66486

Mitre link : CVE-2026-66486

CVE.ORG link : CVE-2026-66486

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-66486", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66486", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T10:34:59.850493Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://git.savannah.gnu.org/cgit/cpio.git", "vendor": "GNU", "product": "cpio", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.15"}], "programFiles": ["copyin.c"], "defaultStatus": "unaffected"}]}], "published": "2026-08-10T11:17:27.907", "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484", "source": "cvd@cert.pl"}, {"url": "https://git.savannah.gnu.org/cgit/cpio.git", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.\n\n\n\n\nThis issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30"}, {"lang": "es", "value": "GNU cpio es vulnerable a la codificaci\u00f3n o escape de salida incorrectos en su funcionalidad de listado de miembros de archivo. Al listar miembros de archivo a trav\u00e9s de cpio -it, los nombres de los miembros se imprimen directamente a la salida sin comillas ni escape. Un atacante puede crear un archivo cpio que contenga nombres de miembros con caracteres de nueva l\u00ednea incrustados o secuencias de escape ANSI, causando entradas de listado falsificadas o inyecci\u00f3n de secuencias de control de terminal cuando se muestra el listado.\n\nEste problema ha sido corregido en el commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30"}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cvd@cert.pl"}