CyberRota Analysis
AI-GeneratedThe diff-so-fancy tool is vulnerable due to improper sanitization of non-SGR terminal control sequences, allowing attackers to embed malicious control sequences in filenames or diff metadata. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection, potentially misleading users during code reviews or executing unintended commands. Developers and security teams using diff-so-fancy should prioritize applying the fix to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized. An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences. Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking. This issue has been fixed in the commit 9c81294