CVE-2026-82710: Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs.
mix usagerules.searchdocs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usagerules: from 0.1.18 before 1.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
usage_rulesto a version that resolves this vulnerability.Fixed in 1.2.8 - Compensating control
Avoid running `mix usage_rules.search_docs` against untrusted packages/documentation until you upgrade `usage_rules` to 1.2.8, since publisher-controlled documentation metadata can inject terminal escape sequences into the terminal output.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers using mix usage_rules.search_docs are exposed when their search results include documentation from a malicious published package. The attacker only needs to publish a package whose indexed documentation contains terminal control sequences; no authentication or privileged role is required.
What can a successful exploit do on a developer's terminal?
It can manipulate the displayed search output, including forging a hexdocs URL or suggested command, hiding text, moving the cursor, erasing lines, or overwriting clipboard contents through OSC 52 sequences. Exploitation occurs when the malicious documentation is surfaced and printed by the command.
How can I determine whether my environment may be affected?
Review whether you use usage_rules versions beginning at 0.1 and run mix usage_rules.search_docs against Hex documentation. A search result containing documentation from an attacker-controlled package is the condition that causes publisher-controlled terminal sequences to be rendered.