CVE-2026-90773: procs through 0.14.12 Terminal Escape Sequence Injection via Command

Q: Who is exposed to this issue?

Users who run procs and view the Command column are exposed if another local user can create processes with attacker-controlled command-line arguments. The impact depends on the terminal emulator interpreting the displayed ANSI or OSC escape sequences.

Q: What does an attacker need to exploit it?

An attacker needs local access sufficient to execute a process with malicious ANSI or OSC escape sequences in its command-line arguments. A user must then view that process's command line in procs for the terminal to interpret the sequences.

Published Sep 13, 2026

Updated

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.

Affected Software

1 affected component

procs<=0.14.12

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users who run procs and view the Command column are exposed if another local user can create processes with attacker-controlled command-line arguments. The impact depends on the terminal emulator interpreting the displayed ANSI or OSC escape sequences.

What does an attacker need to exploit it?

An attacker needs local access sufficient to execute a process with malicious ANSI or OSC escape sequences in its command-line arguments. A user must then view that process's command line in procs for the terminal to interpret the sequences.

CVE-2026-90773: procs through 0.14.12 Terminal Escape Sequence Injection via Command

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?