CVE-2026-50642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50642", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-06-05T13:27:10.270Z", "datePublished": "2026-07-29T09:46:07.962Z", "dateUpdated": "2026-07-29T12:13:51.709Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:46:07.962Z"}, "title": "Terminal Escape Injection in diff\u2011so\u2011fancy", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "type": "CWE"}]}], "affected": [{"vendor": "so-fancy", "product": "diff-so-fancy", "repo": "https://github.com/so-fancy/diff-so-fancy", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.4.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.\n\nAn attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.\n\nSuccessful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.\n\nThis issue has been fixed in the commit\u00a09c81294", "supportingMedia": [{"type": "text/html", "base64": false, "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.<br><br>An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.<br><br>Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.<br><br>This issue has been fixed in the commit&nbsp;9c81294<br>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41874/", "tags": ["third-party-advisory"]}, {"url": "https://github.com/so-fancy/diff-so-fancy", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T12:13:35.752261Z", "id": "CVE-2026-50642", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:13:51.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50642", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T12:13:35.752261Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T12:13:48.295Z"}}], "cna": {"tags": ["x_open-source"], "title": "Terminal Escape Injection in diff\u2011so\u2011fancy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/so-fancy/diff-so-fancy", "vendor": "so-fancy", "product": "diff-so-fancy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.10"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41874/", "tags": ["third-party-advisory"]}, {"url": "https://github.com/so-fancy/diff-so-fancy", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.\n\nAn attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.\n\nSuccessful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.\n\nThis issue has been fixed in the commit\u00a09c81294", "supportingMedia": [{"type": "text/html", "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.<br><br>An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.<br><br>Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.<br><br>This issue has been fixed in the commit&nbsp;9c81294<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:46:07.962Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50642", "state": "PUBLISHED", "dateUpdated": "2026-07-29T12:13:51.709Z", "dateReserved": "2026-06-05T13:27:10.270Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-29T09:46:07.962Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "diff-so-fancy", "repo": "https://github.com/so-fancy/diff-so-fancy", "vendor": "so-fancy", "versions": [{"lessThanOrEqual": "1.4.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "diff\u2011so\u2011fancy does not properly sanitize non\u2011SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.\n\nAn attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.\n\nSuccessful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.\n\nThis issue has been fixed in the commit\u00a09c81294"}, {"lang": "es", "value": "diff?so?fancy no sanitiza correctamente las secuencias de control de terminal no SGR antes de mostrar los datos diff. La aplicaci\u00f3n solo elimina las secuencias ANSI SGR mientras permite que otros caracteres de control, incluyendo el retorno de carro (\\r) y las secuencias de escape (p. ej., OSC, CSI), pasen sin sanitizar.\n\nUn atacante puede incrustar secuencias de control maliciosas en nombres de archivo, metadatos diff o contenido de archivo que se renderizan directamente en el terminal durante la visualizaci\u00f3n del diff. Esto puede llevar a la manipulaci\u00f3n de la salida, incluyendo la suplantaci\u00f3n de nombres de archivo, el borrado de la pantalla del terminal y la inyecci\u00f3n en el portapapeles a trav\u00e9s de secuencias de escape soportadas.\n\nLa explotaci\u00f3n exitosa puede inducir a error a los usuarios durante la revisi\u00f3n de c\u00f3digo, alterar el estado del terminal o resultar en la ejecuci\u00f3n de comandos no deseados mediante el secuestro del portapapeles.\n\nEste problema ha sido corregido en el commit 9c81294"}], "id": "CVE-2026-50642", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50642", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T12:13:35.752261Z", "version": "2.0.3"}}]}, "published": "2026-07-29T11:16:49.617", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/07/CVE-2026-41874/"}, {"source": "cvd@cert.pl", "url": "https://github.com/so-fancy/diff-so-fancy"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "diff-so-fancy: diff-so-fancy: Terminal escape injection allows command execution", "id": "2508367", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508367"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in diff-so-fancy. The application does not properly sanitize non-SGR (Select Graphic Rendition) terminal control sequences, allowing other control characters and escape sequences to pass through. An attacker can embed malicious control sequences in filenames, diff metadata, or file content, which are then rendered directly in the terminal when a user views the diff. This can lead to output manipulation, including filename spoofing and terminal screen clearing, and may result in unintended command execution through clipboard hijacking, potentially misleading users during code review."], "name": "CVE-2026-50642", "public_date": "2026-07-29T09:46:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50642\nhttps://cert.pl/posts/2026/07/CVE-2026-41874/\nhttps://github.com/so-fancy/diff-so-fancy"], "statement": "diff-so-fancy as shipped in Fedora and EPEL is affected by this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "diff-so-fancy", "source": "cna", "vendor": "so-fancy"}, "product": "diff-so-fancy", "vendor": "so-fancy"}], "created": "2026-07-29T15:09:44.563855+00:00", "updated": "2026-08-03T13:30:04.544640+00:00", "vendors": ["so-fancy", "so-fancy$PRODUCT$diff-so-fancy"]}