πŸ” CVE Alert

CVE-2026-66486

UNKNOWN 0.0

Improper Output Encoding in GNU cpio

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

CWE CWE-116
Vendor gnu
Product cpio
Published Aug 10, 2026
Last Updated Aug 10, 2026
Stay Ahead of the Next One

Get instant alerts for gnu cpio

Be the first to know when new unknown vulnerabilities affecting gnu cpio are published β€” delivered to Slack, Telegram or Discord.

Get Free Alerts β†’ Free Β· No credit card Β· 60 sec setup

Affected Versions

GNU / cpio
0 ≀ 2.15

References

NVD β†— CVE.org β†— EPSS Data β†—
cert.pl: https://cert.pl/en/posts/2026/08/CVE-2026-66484 git.savannah.gnu.org: https://git.savannah.gnu.org/cgit/cpio.git

Credits

MichaΕ‚ Majchrowicz (AFINE Team) Marcin Wyczechowski (AFINE Team)