CyberRota Analysis
AI-GeneratedThe vulnerability allows malicious package publishers to manipulate the confirmation prompt displayed by the mix igniter.install command, potentially leading developers to approve harmful dependencies. By embedding ANSI escape sequences in the package metadata, attackers can forge trusted information, such as author names and download counts, misleading developers during package vetting. Organizations using affected versions of the ash-project igniter (0.8.1 to 0.8.4) should prioritize remediation to prevent the risk of integrating malicious packages into their projects.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4.