← Back to CVE List
CVE-2026-90773NVD
Description
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
CVSS Base Metrics
CVSS v3 (3.1)
LOW 3.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS v4 (4.0)
LOW 2.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Weaknesses (CWE)
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Affected & Patched Versions
| Product | Affected Versions | Patched Version |
|---|---|---|
| dalance procs | 0 - <= 0.14.12 | N/A |
References
- https://github.com/dalance/procs/issues/950
- https://github.com/dalance/procs
- https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs
- https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836
- https://www.vulncheck.com/advisories/procs-through-0.14.12-terminal-escape-sequence-injection-via-command