CVE-2026-124992: nushell Data Conversion ser.rs escape_bytes control sequence
A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escapebytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out locally. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low-level privileges. The available data does not indicate that remote attackers can trigger it.
What attacker capability is required?
An attacker needs to manipulate input processed by the Data Conversion Handler's escape_bytes function so that escape, meta, or control sequences are not properly neutralized.
Which versions are affected?
Nushell versions up to and including 0.116.1 are identified as impacted.
Is a fix available?
A pull request to fix the issue exists, but it is awaiting acceptance. The provided data does not identify a released fixed version.