CVE-2026-82584: Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/igniterto a version that resolves this vulnerability.Fixed in 0.8.4 - Configuration
Update Igniter.Project.Deps panel rendering so publisher-controlled fields (meta.description, owner usernames, requirement names, version) are neutralized for ANSI escape/control/meta sequences before being printed in the mix igniter.install confirmation panel.
ash-project/igniter (mix igniter.install confirmation prompt) escape/control sequence sanitization for publisher-controlled metadata fields (meta.description, owner usernames, requirement names, version) = strip or neutralize terminal escape/meta/control sequences (not just newlines) before writing to the terminal
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Developers using mix igniter.install with Igniter versions from 0.8.1 before 0.8.4 are exposed when they review package metadata in the terminal confirmation panel. The practical risk is highest when installing a malicious or typosquatted package and relying on that panel to assess its publisher or popularity.
What does an attacker need to exploit it?
An attacker needs to publish or control a package whose hex metadata contains terminal escape sequences in fields displayed by the confirmation panel, such as the description, owner usernames, requirement names, or version. They must also persuade a developer to run mix igniter.install for that package and approve the altered prompt.
Are default installations affected?
The issue is in the confirmation panel printed by mix igniter.install, so the relevant condition is use of that command on an affected Igniter version. The provided information does not identify any additional configuration requirement.
What can be done if upgrading is not immediately possible?
Do not treat the terminal confirmation panel as trustworthy for package identity, author names, download counts, or other displayed metadata. Independently verify package metadata before approving an installation, particularly for unfamiliar packages or names that could be typosquats.
How can I determine whether I am affected?
Check the installed igniter version. Versions from 0.8.1 up to, but not including, 0.8.4 are affected; 0.8.4 is outside the stated affected range.