MEDIUM 4.8 NVD
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence inject
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
References
- https://github.com/o2sh/onefetch
- https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/ut
- https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/ve
- https://github.com/o2sh/onefetch/issues/1828
- https://www.vulncheck.com/advisories/onefetch-through-2.28.1-terminal-escape-sequence-inje
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-09-27 via NVD.
vulnfeed aggregates 11720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.