CVE-2026-100867: spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of spaceship-prompt through version 4.22.5 are exposed when they enter a directory containing a project manifest whose version field includes terminal control characters.
What does an attacker need to exploit it?
An attacker needs to place ANSI or OSC escape sequences in a version field in a package manifest and induce a victim using the affected prompt to enter that project directory. The victim must interact with the terminal prompt for the malicious content to be rendered.
What can successful exploitation do?
The injected sequences can manipulate terminal output, rewrite the terminal window title, or spoof text displayed to the user. The available data indicates integrity impact only, with no confidentiality or availability impact.