CVE-2026-124992

LOW 3.3

nushell Data Conversion ser.rs escape_bytes control sequence

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out locally. The pull request to fix this issue awaits acceptance.

CWE	CWE-150 CWE-20
Vendor	n/a
Product	nushell
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for n/a nushell

Be the first to know when new low vulnerabilities affecting n/a nushell are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / nushell

0.116.0 0.116.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/433164 vuldb.com: https://vuldb.com/vuln/433164/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124992 vuldb.com: https://vuldb.com/submit/1040563 github.com: https://github.com/nushell/nushell/issues/19197 github.com: https://github.com/nushell/nushell/pull/19443 github.com: https://github.com/nushell/nushell/

Credits

🔍 carfeii (VulDB User) VulDB CNA Team