CVE-2026-100866
onefetch through 2.28.1 Terminal Escape Sequence Injection
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
| CWE | CWE-150 |
| Vendor | o2sh |
| Product | onefetch |
| Published | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for o2sh onefetch
Be the first to know when new low vulnerabilities affecting o2sh onefetch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
o2sh / onefetch
0 ≤ 2.28.1
References
github.com: https://github.com/o2sh/onefetch/issues/1828 github.com: https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/utils/info_field.rs#L43-L55 github.com: https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/version.rs#L33-L35 github.com: https://github.com/o2sh/onefetch vulncheck.com: https://www.vulncheck.com/advisories/onefetch-through-2.28.1-terminal-escape-sequence-injection
Credits
George Chen