Weaknesses of type CWE-150

81 results

Neutralização inadequada de sequências de escape, meta ou controle

Ocorre quando a aplicação não neutraliza adequadamente sequências especiais (escape, meta-caracteres ou controle) antes de processar dados de entrada. Um atacante pode injetar sequências que alteram o comportamento esperado do programa, permitindo execução de comandos não autorizados, manipulação de output ou bypass de validações.

Example

Um sistema que registra mensagens de usuário em logs sem escapar sequências de controle ANSI pode permitir que um atacante injete sequências que limpem o log, ocultam atividades maliciosas ou manipulam a exibição de informações sensíveis para operadores que leem esses logs.

How to mitigate

Valide e escape todas as sequências perigosas (ANSI, shell, XML, HTML, etc.) conforme o contexto de uso dos dados. Use bibliotecas de sanitização apropriadas ao formato (htmlspecialchars() em PHP, shlex.quote() em Python, parametrização em queries SQL) e mantenha listas de caracteres proibidos ou listas brancas de permitidos.

CVE-2025-1693LOWMongoDB Shell may be susceptible to control character Injection via shell outputEPSS 0.2%CVE-2026-73035MEDIUMnpm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape SequencesEPSS 0.2%CVE-2026-6019LOWBaseCookie.js_output() does not neutralize embedded charactersEPSS 0.2%CVE-2026-45803LOWgh: GitHub Actions log output in `gh run view` allows terminal escape sequence injectionEPSS 0.2%CVE-2026-8722MEDIUMNet::Async::Statsd::Client versions through 0.005 for Perl allow metric injectionsEPSS 0.2%CVE-2024-43785LOWgitoxide-core does not neutralize special characters for terminalsEPSS 0.2%CVE-2026-73506MEDIUMOh My Posh: Terminal escape sequence injection via unsanitized prompt segment dataEPSS 0.2%CVE-2025-62845MEDIUMQuRouterEPSS 0.2%CVE-2026-45038HIGHTabby: Dragging and Dropping a File into Tabby Can Lead to Code ExecutionEPSS 0.2%CVE-2024-58251LOWIn netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequeEPSS 0.2%CVE-2025-64494MEDIUMSoft Serve does not sanitize ANSI escape sequences in user inputEPSS 0.2%CVE-2026-54057HIGHKitty vulnerable to command injection via unsanitized OSC 21 query replyEPSS 0.2%CVE-2026-41526MEDIUMIn KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This EPSS 0.2%CVE-2026-40505MEDIUMMuPDF < 1.27 mutool ANSI Injection via MetadataEPSS 0.2%CVE-2025-15311HIGHTanium addressed an unauthorized code execution vulnerability in Tanium Appliance.EPSS 0.2%CVE-2026-90895HIGHMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionEPSS 0.2%CVE-2026-73036MEDIUMBash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.tomlEPSS 0.1%CVE-2026-75483MEDIUMpowerlevel10k Control Character Injection via package.json VersionEPSS 0.1%CVE-2026-90773LOWprocs through 0.14.12 Terminal Escape Sequence Injection via CommandEPSS 0.1%CVE-2026-47090LOWClaude HUD 0.0.12 Terminal Injection via OSC 8 HyperlinksEPSS 0.1%