OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser inte...

CVE-2026-19591

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell

历史摘要 · 未重新核验 · NVD

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_...

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are c

历史摘要 · 未重新核验 · NVD

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are c

历史摘要 · 未重新核验 · OSV.dev

powerlevel10k fails to neutralize control characters in the package.json version field when...

CVE-2026-75483

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt

历史摘要 · 未重新核验 · GitHub Advisory

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled c...

CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune

历史摘要 · 未重新核验 · NVD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications u...

CVE-2026-73414

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/w

历史摘要 · 未重新核验 · NVD

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's...

CVE-2026-73036

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt

历史摘要 · 未重新核验 · GitHub Advisory

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary ...

CVE-2026-73036

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt

历史摘要 · 未重新核验 · NVD

Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

CVE-2026-73036

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt

历史摘要 · 未重新核验 · OSV.dev

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

历史摘要 · 未重新核验 · GitHub Advisory

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal contro...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability t

历史摘要 · 未重新核验 · NVD

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's std...

CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/wind

历史摘要 · 未重新核验 · NVD

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, cod...

CVE-2026-64654

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex

历史摘要 · 未重新核验 · NVD

GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

CVE-2026-64654

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed ex

历史摘要 · 未重新核验 · OSV.dev

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

### Summary Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Shell injection via unescaped parentheses on Windows with CMD

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the defau

历史摘要 · 未重新核验 · GitHub Advisory

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), sy...

CVE-2026-39879

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb

历史摘要 · 未重新核验 · NVD

SQL injection in syslog-ng SQL destionation driver

CVE-2026-39879

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb

历史摘要 · 未重新核验 · OSV.dev

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/state...

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN opt

历史摘要 · 未重新核验 · NVD

OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN opt

历史摘要 · 未重新核验 · OSV.dev